docs: move explanations into short module headers

Non-obvious context sits in a brief header at the top of a module, everything else uses single-line comments. niri binds use spawn-sh strings, so neon only overrides the command.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

modules/nixos/protonvpn.nix

@@ -1,13 +1,8 @@
 { pkgs, ... }:
 
 {
-  # protonvpn uses wireguard tunnels, which break strict reverse path filtering
-  # because packets arrive on the tunnel interface but may be routed back differently.
-  # "loose" checks that the source is routable through *any* interface (not necessarily
-  # the same one), which is sufficient for wireguard while still preventing IP spoofing.
+  # wireguard replies may leave on another interface, so strict rpfilter drops them
   networking.firewall.checkReversePath = "loose";
 
-  environment.systemPackages = with pkgs; [
-    proton-vpn
-  ];
+  environment.systemPackages = [ pkgs.proton-vpn ];
 }