docs: condense comments across the repo

Comments had drifted into multi-paragraph narrative (git commit
lineage, debugging stories, restated code) in several hot spots
(scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix).
Trim every comment to its load-bearing "why" — gotchas, safety
warnings, and non-obvious rationale survive verbatim in substance,
just tightened to 1-2 sentences; historical narrative and anything
already covered in CLAUDE.md is cut. No code/logic changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21

services/desktop/librechat.nix

@@ -9,11 +9,10 @@
     enable = true;
     enableLocalDB = true; # spins up a local, unauthenticated-on-localhost mongodb
 
-    # LibreChat's isEnabled() treats an UNSET var as false, not true — so
-    # registration is closed unless this is explicit, despite .env.example
-    # suggesting true is the default. Only reachable over the tailnet
-    # (trusted interface, see module comment below), so leaving it open is
-    # fine; flip to false once your account exists if you want it locked down.
+    # LibreChat's isEnabled() treats an unset var as false, not true (despite
+    # .env.example suggesting true is the default), so this must be explicit.
+    # Fine to leave open since it's tailnet-only; flip to false once your
+    # account exists to lock it down.
     env.ALLOW_REGISTRATION = true;
 
     credentials = {
@@ -32,10 +31,9 @@
           apiKey = "ollama";
           baseURL = "http://127.0.0.1:11434/v1";
           models = {
-            # schema requires >=1 entry even though fetch=true overwrites it
-            # at runtime with whatever's pulled (see loadModels in
-            # hosts/terra/configuration.nix) — kept roughly in sync anyway
-            # so the UI has sane names before the first fetch completes.
+            # Schema requires >=1 entry even though fetch=true overwrites this at
+            # runtime with whatever's pulled (hosts/terra/configuration.nix) —
+            # kept roughly in sync so the UI has sane names before the first fetch.
             default = [ "gemma4:12b" "qwen3.6:35b-a3b" "VladimirGav/qwen3.8-27B-14GB-IQ4:latest" ];
             fetch = true; # pull the model list from ollama at startup
           };
@@ -43,22 +41,15 @@
         }
       ];
 
-      # Persistent memory is opt-in at the CONFIG level — omitting this block
-      # (as before) leaves the feature entirely off, no matter what a user
-      # toggles in Settings > Personalization. `agent.provider` must match
-      # endpoints.custom[].name above exactly ("Ollama"), which is how the
-      # memory-extraction agent picks a backend/model.
+      # Persistent memory is opt-in at the config level — omitting this block
+      # leaves it off regardless of the user's Settings > Personalization toggle.
+      # `agent.provider` must match endpoints.custom[].name above exactly.
       memory = {
         personalize = true; # still needs a per-user opt-in toggle in the UI
-        # instructions REPLACES the default extraction prompt entirely (not
-        # appended to it) — the 3b model (llama3.2:3b, dropped) was
-        # defaulting to saving things like its own "I am a helpful
-        # assistant..." boilerplate under an invented "user_conversation"
-        # key, and even after adding this prompt, still saved "I am an AI
-        # assistant with tool calling capabilities" as personal_info after
-        # the user introduced THEMSELVES — a capability ceiling, not a
-        # prompting problem. validKeys constrains it to a fixed whitelist
-        # and instructions spells out the bar for each one.
+        # instructions REPLACES the default extraction prompt, not appends to it —
+        # needed because the smaller llama3.2:3b (since dropped) kept saving its
+        # own assistant boilerplate as memories, a capability ceiling rather than
+        # a prompting gap. validKeys whitelists what can be stored.
         validKeys = [ "user_preferences" "personal_info" "ongoing_projects" "technical_context" ];
         agent = {
           enabled = true;