docs: simplify code comments, keep the detail in the README

The registry / multi-user / portable-home rationale lives in the README
(Users, Hosts, Portable home); the corresponding code comments are reduced
to one-liners that point there. No functional change (host derivations are
unchanged).

modules/ssh.nix

@@ -1,9 +1,6 @@
-# Key-only SSH hardening, imported by the hosts that run sshd (T400, Mac Pro,
-# RPi5). The host config still does `services.openssh.enable = true` and opens
-# port 22 next to where it documents the listening service; this module only
-# tightens the policy so a host opting into sshd cannot accidentally ship
-# password/root login. Authorized keys are owned per-user by the identity
-# registry (users/registry.nix, applied via modules/users.nix), not here.
+# Key-only sshd hardening, imported by hosts that run sshd (T400, Mac Pro,
+# RPi5). Authorized keys are owned per-user by the registry (modules/users.nix),
+# not here.
 { ... }:
 {
   services.openssh.settings = {

modules/users.nix

@@ -1,9 +1,5 @@
-# System-level user accounts, built from the identity registry
-# (users/registry.nix). `hostUsers` is the host's user set, threaded by mkHost
-# from the flake host table; `userRegistry` is the global identity table passed
-# as a specialArg. Every account's identity -- description, groups, authorized
-# keys -- comes from its registry entry, so no user data is hardcoded here and a
-# host may declare any number of users.
+# System user accounts, built from the registry (users/registry.nix) for the
+# host's `hostUsers` set. See README "Users".
 {
   config,
   pkgs,
@@ -29,9 +25,7 @@
       openssh.authorizedKeys.keys = id.sshAuthorizedKeys;
       shell = pkgs.zsh;
     }
-    # Keep this user's systemd --user instance running without an open login
-    # session (e.g. for home-manager user timers). Only emitted when the host
-    # table opts in, so hosts that don't set it leave linger entirely unmanaged.
+    # linger opt-in (host table); left unmanaged when unset.
     // lib.optionalAttrs (spec ? linger) { inherit (spec) linger; }
   ) hostUsers;