docs: condense comments across the repo

Comments had drifted into multi-paragraph narrative (git commit
lineage, debugging stories, restated code) in several hot spots
(scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix).
Trim every comment to its load-bearing "why" — gotchas, safety
warnings, and non-obvious rationale survive verbatim in substance,
just tightened to 1-2 sentences; historical narrative and anything
already covered in CLAUDE.md is cut. No code/logic changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21

services/network/pihole.nix

@@ -53,17 +53,11 @@ in
     };
   };
 
-  # Bind-mount source must exist (podman won't create it), and it must be
-  # owned by 1000 — the `pihole` user FTL drops to after the entrypoint's root
-  # phase. Podman here is rootful with no userns remapping, so that number is
-  # the same inside and out (on the host it collides with darman, harmlessly).
-  #
-  # Ownership of gravity.db alone is not enough: sqlite creates a sibling
-  # gravity.db-journal for every write transaction, so FTL needs to CREATE
-  # files in this directory. Root-owned, it fails with
-  #   open(/etc/pihole/gravity.db-journal) - (14)
-  #   attempt to write a readonly database
-  # which reads like a corrupt or read-only database and is neither.
+  # Bind-mount source must exist (podman won't create it) and be owned by 1000,
+  # the `pihole` user FTL drops to (rootful podman, no userns remapping, so the
+  # uid is the same inside and out). Must be the whole DIRECTORY, not just
+  # gravity.db — sqlite needs to create a sibling gravity.db-journal per write,
+  # and a root-owned dir makes that fail with a misleading "readonly database".
   systemd.tmpfiles.rules = [ "d /var/lib/pihole 0750 1000 1000 -" ];
 
   # Seed the adlists above into gravity. `INSERT OR IGNORE` keyed on the URL