docs: condense comments across the repo

Comments had drifted into multi-paragraph narrative (git commit
lineage, debugging stories, restated code) in several hot spots
(scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix).
Trim every comment to its load-bearing "why" — gotchas, safety
warnings, and non-obvious rationale survive verbatim in substance,
just tightened to 1-2 sentences; historical narrative and anything
already covered in CLAUDE.md is cut. No code/logic changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21

services/media/prowlarr.nix

@@ -15,21 +15,16 @@
 {
   services.prowlarr.enable = true;
 
-  # `nofail` is NOT optional here: without it this bind is RequiredBy
-  # local-fs.target, so an unassembled RAID array fails that target and drops
-  # jupiter into emergency mode — which is a dead end, since root is locked and
-  # sulogin has nothing to offer on a headless box. It defeats the `nofail` on
-  # /mnt/data itself (a mount layered on the array is what actually took the
-  # target down). Let this bind fail alone instead.
+  # `nofail` is not optional: without it this bind is RequiredBy local-fs.target,
+  # so an unassembled array drops jupiter into emergency mode — a dead end on a
+  # headless box with root locked. Let this bind fail alone instead.
   fileSystems."/var/lib/private/prowlarr" = {
     device = "/mnt/data/AppData/prowlarr/config";
     fsType = "none";
     options = [ "bind" "nofail" ];
   };
 
-  # systemd derives RequiresMountsFor from the unit's own paths, which here is
-  # only /var/lib/prowlarr on the eMMC — so without this prowlarr starts happily
-  # with the array absent and writes its state onto the 29G OS disk. Pin it to
-  # the array so it fails loudly instead.
+  # systemd derives RequiresMountsFor only from /var/lib/prowlarr (eMMC) — pin
+  # it to the array too, or prowlarr starts happily and writes state to the OS disk.
   systemd.services.prowlarr.unitConfig.RequiresMountsFor = [ "/mnt/data" ];
 }