docs: condense comments across the repo

Comments had drifted into multi-paragraph narrative (git commit
lineage, debugging stories, restated code) in several hot spots
(scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix).
Trim every comment to its load-bearing "why" — gotchas, safety
warnings, and non-obvious rationale survive verbatim in substance,
just tightened to 1-2 sentences; historical narrative and anything
already covered in CLAUDE.md is cut. No code/logic changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21

services/experimental/cinephage.nix

@@ -1,12 +1,11 @@
 { config, ... }:
 
-# Cinephage — indexer search + streaming/library manager. Runs the official
-# container image, not upstream's nix flake module: its npmDepsHash is stale
-# against its own package-lock.json, and a transitive dep hard-enforces pnpm,
-# breaking the nix-sandboxed npm build regardless. Docker is the actually-
-# maintained path. BETTER_AUTH_SECRET (paired sops secret in
-# hosts/jupiter/secrets.nix) signs sessions/encrypts stored API keys — must
-# be static, not app-generated, or losing it invalidates everything.
+# Cinephage — indexer search + streaming/library manager, run as the official
+# container image rather than upstream's nix flake module (its npmDepsHash is
+# stale and a transitive dep hard-enforces pnpm, breaking the sandboxed npm
+# build). BETTER_AUTH_SECRET (paired sops secret, hosts/jupiter/secrets.nix)
+# signs sessions and encrypts stored API keys — keep it static, since losing
+# it invalidates everything.
 {
   virtualisation.oci-containers.containers.cinephage = {
     image = "ghcr.io/moldytaint/cinephage:latest";

services/experimental/mediamanager.nix

@@ -1,10 +1,10 @@
 { config, ... }:
 
-# MediaManager — media request/library manager. Module comes from the
-# community flake input `mediamanager-nix`, not nixpkgs. Paired sops secret
-# in hosts/jupiter/secrets.nix — without it the module mints+discards a
-# random auth token_secret on every restart, logging everyone out.
-# Port 8010: 8000 is taken by audiobookshelf on this host.
+# MediaManager — media request/library manager (module from the
+# `mediamanager-nix` flake input, not nixpkgs). The paired sops secret
+# (hosts/jupiter/secrets.nix) is required — without it the module mints a
+# random token_secret every restart, logging everyone out; port 8010 since
+# audiobookshelf already holds 8000.
 {
   services.media-manager = {
     enable = true;
@@ -45,9 +45,9 @@
     MEDIAMANAGER_INDEXERS__PROWLARR__API_KEY=${config.sops.placeholder.prowlarr_api_key}
   '';
 
-  # HighSeas/{Movies,Shows,images,Downloads} are darman:users 755 on disk —
-  # group has no write bit. media-manager is in "users" (below); the dirs
-  # themselves were chmod g+w by hand once (not declarative — see CLAUDE.md
-  # gotchas), since this is pre-existing data, not something tmpfiles owns.
+  # HighSeas/{Movies,Shows,images,Downloads} are darman:users 755 (no group
+  # write bit); media-manager is in "users" (below), and the dirs were
+  # chmod g+w by hand once since this is pre-existing data, not something
+  # tmpfiles owns.
   users.users.media-manager.extraGroups = [ "users" ];
 }