chore(deploy): strip infra commentary from asset/ config files

These ship in a public repo; topology narration in nginx, systemd,
firewalld, and env templates is gratuitous. Keep the config terse —
directives speak for themselves.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

asset/systemd/moments-api-cert.path

@@ -1,11 +1,7 @@
 [Unit]
 Description=Watch host cert for moments-api
-Documentation=https://git.lair.cafe/grenade/architecture
 
 [Path]
-# Hostname is substituted at deploy time. step-ca rotates host certs every
-# 24h; rustls reads them at process start, so the API must restart on
-# rotation. Read-only public timeline — a few seconds of churn is fine.
 PathChanged=/etc/pki/tls/misc/{{HOSTNAME}}.pem
 Unit=moments-api-cert-reload.service