docs: condense comments across the repo

Comments had drifted into multi-paragraph narrative (git commit
lineage, debugging stories, restated code) in several hot spots
(scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix).
Trim every comment to its load-bearing "why" — gotchas, safety
warnings, and non-obvious rationale survive verbatim in substance,
just tightened to 1-2 sentences; historical narrative and anything
already covered in CLAUDE.md is cut. No code/logic changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21

services/vpn/tailscale.nix

@@ -1,9 +1,9 @@
 { config, ... }:
 
-# Tailscale node joined to the self-hosted headscale control server.
-# Auto-registers on boot from a sops pre-auth key. Requires the importing host
-# to declare `sops.secrets.tailscale_authkey` (see each host's secrets.nix).
-# Not for the VM (no sops).
+# Tailscale node joined to the self-hosted headscale control server,
+# auto-registering on boot from a sops pre-auth key — importing hosts must
+# declare `sops.secrets.tailscale_authkey` (see each host's secrets.nix).
+# Not used by the VM target (no sops there).
 {
   services.tailscale = {
     enable = true;
@@ -14,11 +14,11 @@
   # Reach the host's services over the tailnet without opening LAN ports.
   networking.firewall.trustedInterfaces = [ "tailscale0" ];
 
-  # The upstream unit is a one-shot with no Restart, so a login attempt made
-  # before the control server is reachable fails permanently until someone
-  # starts it by hand. That's the norm on a first boot — neptun hosts headscale
-  # itself, and the other hosts race it. 30s spacing also keeps restarts clear
-  # of systemd's default start limit (5 within 10s).
+  # The upstream unit is a one-shot with no Restart, so a login attempted
+  # before the control server is up fails permanently until restarted by
+  # hand — the norm on first boot, since neptun hosts headscale itself and
+  # other hosts race it. 30s spacing keeps retries clear of systemd's default
+  # start limit (5 within 10s).
   systemd.services.tailscaled-autoconnect.serviceConfig = {
     Restart = "on-failure";
     RestartSec = 30;