docs: condense comments across the repo

Comments had drifted into multi-paragraph narrative (git commit
lineage, debugging stories, restated code) in several hot spots
(scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix).
Trim every comment to its load-bearing "why" — gotchas, safety
warnings, and non-obvious rationale survive verbatim in substance,
just tightened to 1-2 sentences; historical narrative and anything
already covered in CLAUDE.md is cut. No code/logic changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21

services/experimental/cinephage.nix

@@ -1,12 +1,11 @@
 { config, ... }:
 
-# Cinephage — indexer search + streaming/library manager. Runs the official
-# container image, not upstream's nix flake module: its npmDepsHash is stale
-# against its own package-lock.json, and a transitive dep hard-enforces pnpm,
-# breaking the nix-sandboxed npm build regardless. Docker is the actually-
-# maintained path. BETTER_AUTH_SECRET (paired sops secret in
-# hosts/jupiter/secrets.nix) signs sessions/encrypts stored API keys — must
-# be static, not app-generated, or losing it invalidates everything.
+# Cinephage — indexer search + streaming/library manager, run as the official
+# container image rather than upstream's nix flake module (its npmDepsHash is
+# stale and a transitive dep hard-enforces pnpm, breaking the sandboxed npm
+# build). BETTER_AUTH_SECRET (paired sops secret, hosts/jupiter/secrets.nix)
+# signs sessions and encrypts stored API keys — keep it static, since losing
+# it invalidates everything.
 {
   virtualisation.oci-containers.containers.cinephage = {
     image = "ghcr.io/moldytaint/cinephage:latest";