Cut the comment bloat from the Podman playbooks

Comment blocks now stay within three lines and explain only the non-obvious. Long histories, include examples, and commented-out code are gone. No task, key, or value changed; the only data change is comment text inside the generated unit files.

caddy/roles/podman/tasks/main.yaml

@@ -1,9 +1,4 @@
 ---
-# Rootless Podman prerequisites. Shared by every container playbook.
-#
-# This playbook runs AS the container user; it does not use become to reach it.
-# Root-only steps elevate individually. Keeping the connection's PAM session
-# intact is what lets `systemctl --user` work without setting XDG_RUNTIME_DIR.
 
 - name: Fail if the connecting user resolved to root
   ansible.builtin.assert:
@@ -20,34 +15,21 @@
   ansible.builtin.apt:
     name:
       - podman
-      # Everything below is only a Recommends, not a Depends, of podman or
-      # netavark. apt installs Recommends by default, so these would normally
-      # arrive on their own; listing them makes the requirement explicit and
-      # keeps it true under --no-install-recommends.
-      # - aardvark-dns   # container-name DNS: Caddy resolves every upstream by name
-      # - nftables       # netavark's firewall backend; Podman 6 dropped iptables
-      # - passt          # pasta, the rootless network backend
-      # - uidmap         # newuidmap/newgidmap, required for rootless user namespaces
     state: present
     update_cache: true
     cache_valid_time: 3600
   become: true
 
-# Without lingering, the user's systemd manager is torn down when the last
-# session ends: Quadlet units stop, and they never start at boot.
+# Without lingering, the user manager stops with the last session and units
+# never start at boot.
 - name: Enable systemd lingering for {{ podman_user }}
   ansible.builtin.command: "loginctl enable-linger {{ podman_user }}"
   args:
     creates: "/var/lib/systemd/linger/{{ podman_user }}"
   become: true
 
-# Rootless containers cannot bind host ports below 1024 unless the kernel
-# floor is lowered. Caddy publishes 80/443.
-#
-# This is applied inline rather than via a handler on purpose: handlers only
-# run at the end of the play, by which point Caddy has already tried (and
-# failed) to bind port 80. sysctl -w touches the running kernel; the file
-# makes it survive a reboot.
+# Rootless containers cannot bind ports below 1024 unless the kernel floor is
+# lowered. Applied inline, because a handler would run after Caddy already bound.
 - name: Read the current unprivileged port floor
   ansible.builtin.command: sysctl -n net.ipv4.ip_unprivileged_port_start
   register: podman_port_floor