docs: move explanations into short module headers

Non-obvious context sits in a brief header at the top of a module, everything else uses single-line comments. niri binds use spawn-sh strings, so neon only overrides the command.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

modules/home-manager/git.nix

@@ -1,3 +1,7 @@
+# Commits are signed with each machine's ~/.ssh/id_ed25519 through the ssh
+# agent. gitea verifies them against the account keys; allowed_signers gives
+# the local git the same trust, so `git log --show-signature` resolves too.
+
 {
   config,
   lib,
@@ -7,18 +11,12 @@
 
 let
   email = "aaron@0x29a.ch";
-
-  # public half of every machine's ~/.ssh/id_ed25519, each one verified as a
-  # signing key in gitea. the key a host signs with is picked up from the key
-  # file itself, this list only tells the local git which machines to trust
   signingKeys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDkhvvTUcBSQdtXjX+Mw2Bp8HHhtiBm8aJi4ZxiBgZR aaron@neon"
   ];
 in
 {
-  # gitea verifies signatures against the account keys, this teaches the local
-  # git the same trust so `git log --show-signature` resolves as well
   xdg.configFile."git/allowed_signers".text = lib.concatMapStrings (
     key: "${email} ${key}\n"
   ) signingKeys;
@@ -26,9 +24,7 @@ in
   programs.git = {
     enable = true;
     settings = {
-      push = {
-        autoSetupRemote = true;
-      };
+      push.autoSetupRemote = true;
       user = {
         name = "aaron";
         inherit email;
@@ -37,8 +33,7 @@ in
     };
     signing = {
       format = "ssh";
-      # point at the *public* key so ssh-keygen signs through the ssh agent
-      # instead of reading the passphrase protected private key from disk
+      # the public key makes ssh-keygen sign through the agent
       key = "${config.home.homeDirectory}/.ssh/id_ed25519.pub";
       signer = "${pkgs.openssh}/bin/ssh-keygen";
       signByDefault = true;