docs: condense comments across the repo

Comments had drifted into multi-paragraph narrative (git commit
lineage, debugging stories, restated code) in several hot spots
(scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix).
Trim every comment to its load-bearing "why" — gotchas, safety
warnings, and non-obvious rationale survive verbatim in substance,
just tightened to 1-2 sentences; historical narrative and anything
already covered in CLAUDE.md is cut. No code/logic changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21

hosts/mars/configuration.nix

@@ -25,13 +25,12 @@
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
-  # jupiter's samba share (services/network/samba.nix) — mounted on demand so
-  # mars doesn't stall boot/login when jupiter is off or unreachable. This is
-  # also where Hermes's shared dropbox lives now (hermes-agent.nix). Modes are
-  # tighter than terra's equivalent mount (0770 not 0755, gid=hermes not
-  # gid=users) since the hermes-agent container (uid 986, gid 983 — no podman
-  # userns remapping, see services/network/pihole.nix) needs group write into
-  # it, not just darman.
+  # jupiter's samba share (services/network/samba.nix), mounted on demand so
+  # mars doesn't stall when jupiter is off — also where Hermes's shared
+  # dropbox lives (hermes-agent.nix). Tighter modes than terra's equivalent
+  # mount (0770/gid=hermes, not 0755/gid=users) since the hermes-agent
+  # container (uid 986/gid 983, no podman userns remapping) needs group
+  # write here, not just darman.
   fileSystems."/mnt/jupiter" = {
     device = "//jupiter/data";
     fsType = "cifs";
@@ -43,11 +42,9 @@
       "dir_mode=0770"
       "nofail"
       "x-systemd.automount"    # lazy-mount so boot doesn't stall if jupiter's down
-      # NO idle-timeout here (unlike terra's equivalent mount): hermes-agent's
-      # podman-hermes-agent.service RequiresMountsFor this path, so an idle
-      # auto-unmount tears the container down with it — confirmed the hard
-      # way, it killed the service ~60-70s after every start with no crash
-      # or error, just "Unmounting /mnt/jupiter" right before the stop.
+      # NO idle-timeout here (unlike terra's): podman-hermes-agent.service
+      # RequiresMountsFor this path, so an idle auto-unmount silently kills
+      # the container with it — confirmed the hard way (~60-70s per start).
       "x-systemd.mount-timeout=10s"
       "_netdev"
     ];