docs: condense comments across the repo

Comments had drifted into multi-paragraph narrative (git commit
lineage, debugging stories, restated code) in several hot spots
(scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix).
Trim every comment to its load-bearing "why" — gotchas, safety
warnings, and non-obvious rationale survive verbatim in substance,
just tightened to 1-2 sentences; historical narrative and anything
already covered in CLAUDE.md is cut. No code/logic changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21

services/monitoring/victoriametrics.nix

@@ -15,10 +15,9 @@
 
     prometheusConfig = {
       global.scrape_interval = "5s";
-      # Explicit, and equal to the interval on purpose. The Prometheus default
-      # is 10s, and VictoriaMetrics silently clamps scrape_timeout down to
-      # scrape_interval rather than erroring — so leaving it implicit means the
-      # config says 10s while the scraper uses 5s. Say what actually happens.
+      # Explicit and equal to the interval on purpose: VictoriaMetrics silently
+      # clamps scrape_timeout down to scrape_interval, so leaving the Prometheus
+      # default (10s) here would misstate what actually happens.
       global.scrape_timeout = "5s";
 
       scrape_configs = [
@@ -44,14 +43,10 @@
           ];
         }
         # mercury is a Pi scraped over the tailnet, so it gets its own job at a
-        # slower cadence: at the 5s global it would time out (see above) and
-        # the series would show gaps rather than late samples.
-        #
-        # A separate cadence REQUIRES a separate job — scrape_interval is a
-        # per-job setting and job_name has to be unique — which means mercury's
-        # `job` label differs from every other host's. Select on `host` (set on
-        # every target below) rather than job="node-exporter" in dashboards and
-        # alerts, or mercury drops out of them silently.
+        # slower cadence to avoid timing out at the 5s global. A separate cadence
+        # requires a separate job (scrape_interval is per-job), so mercury's
+        # `job` label differs from every other host's — select on `host` in
+        # dashboards/alerts, not job="node-exporter", or mercury drops out silently.
         {
           job_name = "node-exporter-mercury";
           scrape_interval = "15s";
@@ -81,31 +76,22 @@
   # another host or the tailnet is temporarily unavailable.
   systemd.services.victoriametrics.after = [ "tailscaled-autoconnect.service" ];
 
-  # Keep the TSDB off jupiter's 29G eMMC. The module hardcodes
-  # -storageDataPath=/var/lib/<stateDir> and runs DynamicUser, so without this
-  # the data lands on the OS disk — a continuous small-write workload aimed at
-  # the one disk here with no headroom and finite write endurance. Same
-  # bind-onto-/var/lib/private pattern as prowlarr.nix and seerr.nix; see
-  # prowlarr.nix for why the mount targets the private path and not the public
-  # /var/lib/victoriametrics.
-  #
-  # `nofail` is NOT optional — again see prowlarr.nix: without it this bind is
-  # RequiredBy local-fs.target, so an unassembled array drops jupiter into an
-  # emergency shell that a headless box cannot be rescued from.
+  # Keep the TSDB off jupiter's 29G eMMC: the module hardcodes
+  # -storageDataPath=/var/lib/<stateDir> under DynamicUser, so without this bind
+  # a continuous small-write workload lands on the one disk with no headroom.
+  # Same /var/lib/private bind pattern as prowlarr.nix and seerr.nix — see
+  # prowlarr.nix for why it targets the private path, and why `nofail` here is
+  # not optional.
   fileSystems."/var/lib/private/victoriametrics" = {
     device = "/mnt/data/AppData/victoriametrics";
     fsType = "none";
     options = [ "bind" "nofail" ];
   };
 
-  # The bind above needs its SOURCE to exist or the mount fails — and because
-  # it is `nofail` that failure is quiet: RequiresMountsFor below is satisfied
-  # by /mnt/data itself, so VictoriaMetrics would start regardless and write to
-  # the eMMC, which is the exact thing the bind exists to prevent. prowlarr.nix
-  # gets away without this only because its directory predates the module
-  # (migrated from ZimaOS). This is a fresh service, so it creates its own,
-  # same as seerr.nix. 0755 darman:users matches the other AppData dirs, which
-  # matters because /mnt/data/AppData itself is drwx--x--- darman:users.
+  # The bind above needs its source dir to exist or it quietly fails (`nofail`)
+  # and VictoriaMetrics falls through to writing the eMMC anyway — this is a
+  # fresh service so, unlike prowlarr.nix's pre-existing dir, it must create its
+  # own (same as seerr.nix). 0755 darman:users matches the other AppData dirs.
   systemd.tmpfiles.rules = [
     "d /mnt/data/AppData/victoriametrics 0755 darman users -"
   ];