docs: condense comments across the repo

Comments had drifted into multi-paragraph narrative (git commit
lineage, debugging stories, restated code) in several hot spots
(scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix).
Trim every comment to its load-bearing "why" — gotchas, safety
warnings, and non-obvious rationale survive verbatim in substance,
just tightened to 1-2 sentences; historical narrative and anything
already covered in CLAUDE.md is cut. No code/logic changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21

services/media/sabnzbd.nix

@@ -1,18 +1,13 @@
 { config, ... }:
 
-# SABnzbd — usenet downloader. Migrated off a reused hand-authored ini
-# (servers/API key/history originally imported from the old ZimaOS docker
-# stack) onto NixOS-managed `settings`, per the module's own deprecation
-# notice for `configFile`. Only the values that differ from SABnzbd's own
-# built-in defaults are declared here — everything else falls back to the
-# same defaults SABnzbd was already using.
+# SABnzbd — usenet downloader, migrated off a hand-authored ini (imported from
+# the old ZimaOS docker stack) onto NixOS-managed `settings`. Only values that
+# differ from SABnzbd's own defaults are declared here.
 #
-# `admin_dir`/`log_dir` MUST stay absolute: the module writes the merged ini
-# to /var/lib/sabnzbd/sabnzbd.ini (eMMC), and both dirs are otherwise
-# relative to wherever the ini lives. Pointing them back at the ORIGINAL
-# /mnt/data location keeps the existing download queue/history database
-# (admin_dir) intact — a relative default here would silently "reset"
-# SABnzbd to an empty queue on first switch, even though nothing was deleted.
+# `admin_dir`/`log_dir` must stay absolute: the module writes the merged ini to
+# /var/lib/sabnzbd/sabnzbd.ini (eMMC), so a relative default would resolve
+# there instead of the original /mnt/data location — silently "resetting"
+# SABnzbd to an empty queue/history on first switch, without deleting anything.
 {
   services.sabnzbd = {
     enable = true;
@@ -73,17 +68,15 @@
   # Write access to the shared downloads dir (owned darman:users on disk).
   users.users.sabnzbd.extraGroups = [ "users" ];
 
-  # download/complete/admin dirs all live on the array, but systemd only
-  # derives RequiresMountsFor from /var/lib/sabnzbd (eMMC) — so with the array
-  # absent sabnzbd would start and download onto the 29G OS disk.
+  # download/complete/admin dirs live on the array, but systemd only derives
+  # RequiresMountsFor from /var/lib/sabnzbd (eMMC) — without this, a missing
+  # array lets sabnzbd start and download onto the 29G OS disk instead.
   systemd.services.sabnzbd.unitConfig.RequiresMountsFor = [ "/mnt/data" ];
   systemd.services.fix-downloads-perms.unitConfig.RequiresMountsFor = [ "/mnt/data" ];
 
-  # SABnzbd hardcodes completed job folders to 0700 on every job, ignoring
-  # the ini's `umask` (that only covers files during unpack, not the job
-  # dir itself). setgid on Downloads keeps the group as "users" but perm
-  # bits still come back zeroed, locking out cinephage/mediamanager — sweep
-  # it clean instead of fighting SABnzbd.
+  # SABnzbd hardcodes completed job folders to 0700, ignoring the ini's `umask`
+  # (unpack-only) — setgid keeps the group but perm bits still zero out and
+  # lock out cinephage/mediamanager, so sweep it clean on a timer instead.
   systemd.services.fix-downloads-perms = {
     description = "Fix group perms SABnzbd resets on completed downloads";
     serviceConfig.Type = "oneshot";