docs: condense comments across the repo

Comments had drifted into multi-paragraph narrative (git commit
lineage, debugging stories, restated code) in several hot spots
(scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix).
Trim every comment to its load-bearing "why" — gotchas, safety
warnings, and non-obvious rationale survive verbatim in substance,
just tightened to 1-2 sentences; historical narrative and anything
already covered in CLAUDE.md is cut. No code/logic changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21

services/media/jellyfin.nix

@@ -6,20 +6,17 @@
     dataDir = "/mnt/data/AppData/jellyfin";
     cacheDir = "/mnt/data/AppData/jellyfin/cache";
   };
-  # "users" so the shared library stays readable (see the UMask note below);
-  # "video"/"render" for the DRI nodes used by hardware transcoding. renderD128
-  # happens to be 0666 so VAAPI alone would work without this, but card1 is
-  # 0660 root:video — and neither mode is guaranteed, so don't rely on it. The
-  # groups are harmless on a host with no GPU: they exist regardless, and this
-  # module stays host-agnostic (the DRIVER is enabled per-host, e.g. jupiter's
-  # hardware.graphics + intel-media-driver).
+  # "users" keeps the shared library readable (see the UMask note below);
+  # "video"/"render" cover the DRI nodes for hardware transcoding — card1 is
+  # 0660 root:video (not guaranteed 0666 like renderD128), so don't rely on
+  # device perms alone. Harmless on a GPU-less host: the driver itself is
+  # enabled per-host (e.g. jupiter's hardware.graphics + intel-media-driver).
   users.users.jellyfin.extraGroups = [ "users" "video" "render" ];
 
-  # The upstream module hardcodes UMask=0077 — root cause of jellyfin writing
-  # trickplay thumbnails into stray new show folders it invented itself,
-  # owned jellyfin:jellyfin 700, invisible to every other service sharing
-  # the library (cinephage, mediamanager, ...). New files/dirs it creates
-  # from here on inherit group "users" (library roots are setgid, see the
-  # one-time chmod g+s done by hand) and stay group-writable.
+  # The upstream module hardcodes UMask=0077, which made jellyfin write
+  # trickplay thumbnails into new folders owned jellyfin:jellyfin 700 —
+  # invisible to every other service sharing the library (cinephage,
+  # mediamanager). Forcing 0002 makes new files inherit group "users"
+  # (library roots are setgid via a one-time chmod g+s) and stay group-writable.
   systemd.services.jellyfin.serviceConfig.UMask = lib.mkForce "0002";
 }