docs: condense comments across the repo

Comments had drifted into multi-paragraph narrative (git commit
lineage, debugging stories, restated code) in several hot spots
(scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix).
Trim every comment to its load-bearing "why" — gotchas, safety
warnings, and non-obvious rationale survive verbatim in substance,
just tightened to 1-2 sentences; historical narrative and anything
already covered in CLAUDE.md is cut. No code/logic changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21

services/network/samba.nix

@@ -22,14 +22,13 @@
     };
   };
 
-  # Samba keeps its own NTLM password DB, separate from the system password;
-  # `services.samba` never sets it, so logins fail until provisioned. Runs
-  # AFTER samba-smbd so its state dir exists — an activation script runs too
-  # early and smbpasswd fails to init the passdb. Reads a single-line
-  # password from the first file that exists:
+  # Samba keeps its own NTLM password DB, separate from the system password —
+  # `services.samba` never sets it, and this runs as a service (not an
+  # activation script, which fires too early for smbpasswd's passdb) after
+  # samba-smbd. Reads a single-line password from the first existing file,
+  # feeding it twice since smbpasswd prompts new+confirm:
   #   Real host: /run/secrets/samba_password  (sops-nix, see secrets.nix)
   #   VM test:   /etc/samba/smb-password       (plaintext, see vm.nix)
-  # smbpasswd prompts new + confirm, so the value is fed twice.
   systemd.services.samba-smbpasswd = {
     description = "Provision Samba password for darman";
     after = [ "samba-smbd.service" ];