docs(self-host): tighten the env example comments (#2722)

deploy/self-hosting/.env.example

@@ -1,26 +1,21 @@
-# Every variable docker-compose.yml reads from this file is named here:
-# uncommented when it has no default, commented with its default when it has one.
-# A name absent from this file is one Compose does not forward, and it reaches a
-# service only through a Compose override file that adds it to that service's
-# environment. packages/config/src/__tests__/DeployEnvCoverage.test.ts fails when
-# a Compose edit forgets the matching line here. Compose expands this file from
-# top to bottom, so a line written with ${...} has to sit below every name it
-# reads.
+# Every variable docker-compose.yml reads is named here, uncommented when it has
+# no default and commented with its default when it has one. A name absent from
+# this file reaches a service only through a Compose override. Compose expands
+# top to bottom, so a line using ${...} must sit below every name it reads.
 
 FLUXER_DOMAIN=chat.example.com
 FLUXER_PUBLIC_SCHEME=https
 FLUXER_PUBLIC_PORT=443
 
-# The three lines above are the address browsers use, and every endpoint the
-# services advertise carries the port from FLUXER_PUBLIC_PORT. They do not move
-# what the host publishes. FLUXER_HTTP_PORT and FLUXER_HTTPS_PORT further down
-# do that, and a non-default port needs the matching one set as well. Both
-# complete recipes are written out beside them.
+# The lines above are the address browsers use, and every advertised endpoint
+# carries FLUXER_PUBLIC_PORT. They do not move what the host publishes.
+# FLUXER_HTTP_PORT and FLUXER_HTTPS_PORT below do that, and a non-default port
+# needs the matching one set as well. Complete recipes sit beside them.
 
 # How browsers reach this instance.
 #
 # Default: Fluxer binds 80 and 443 and gets its own Let's Encrypt certificate.
-# Point DNS at this host and there is nothing else to configure.
+# Point DNS at this host.
 #
 # Behind your own reverse proxy (nginx, Traefik, HAProxy, Cloudflare Tunnel,
 # another Caddy): uncomment COMPOSE_FILE below. Fluxer then serves plain HTTP on
@@ -65,13 +60,12 @@ FLUXER_PUBLIC_PORT=443
 # hostname means automatic HTTPS on 443 whatever FLUXER_PUBLIC_SCHEME says.
 #FLUXER_EDGE_SITE_ADDRESS=https://chat.example.com
 
-# The old name for the value above. It is read only when
-# FLUXER_EDGE_SITE_ADDRESS is unset, so an existing .env keeps the listener
-# it already had. Rename it to FLUXER_EDGE_SITE_ADDRESS at your convenience.
+# The old name for the value above, read only when FLUXER_EDGE_SITE_ADDRESS is
+# unset, so an existing .env keeps the listener it already had.
 #FLUXER_CADDY_SITE_ADDRESS=
 
-# Host side of the edge's publishes, and the only two names that decide which
-# host ports Fluxer binds. The container side is fixed. Container 80 carries the
+# Host side of the edge's publishes, and the only names that decide which host
+# ports Fluxer binds. The container side is fixed. Container 80 carries the
 # HTTP to HTTPS redirect and the Let's Encrypt HTTP challenge under an https
 # scheme, and the site itself under an http one. Container 443 carries the TLS
 # site. FLUXER_HTTPS_PORT moves the TCP and the UDP publish together, because
@@ -251,7 +245,7 @@ LIVEKIT_API_SECRET=CHANGE_ME
 # LiveKit finds the address browsers dial by asking a STUN server. A host that
 # cannot reach one over UDP stops with "could not resolve external IP", and the
 # address is then set by hand: put it in FLUXER_LIVEKIT_NODE_IP and set
-# FLUXER_LIVEKIT_USE_EXTERNAL_IP to false. Point the two STUN entries at another
+# FLUXER_LIVEKIT_USE_EXTERNAL_IP to false. Point the STUN entries at another
 # server to keep the lookup and leave Google out of it.
 #FLUXER_LIVEKIT_USE_EXTERNAL_IP=false
 #FLUXER_LIVEKIT_NODE_IP=203.0.113.10
@@ -279,11 +273,11 @@ FLUXER_CAPTCHA_TURNSTILE_SITE_KEY=
 FLUXER_CAPTCHA_TURNSTILE_SECRET_KEY=
 FLUXER_DISCOVERY_ENABLED=true
 
-# Container memory. The 25 limits sum to 18.25 GiB, which is a sum of ceilings and
+# Container memory. The limits sum to 18.25 GiB, which is a sum of ceilings and
 # not an allocation, so the defaults fit a host with 8 GB and are sized for 16 GB.
-# The four reservations are cgroup memory.low, which biases the kernel away from
-# reclaiming from the services whose death takes the whole instance down. They do
-# not reserve anything. Lower the limits on a smaller host.
+# The reservations are cgroup memory.low, which biases the kernel away from
+# reclaiming from services whose death takes the instance down. They reserve
+# nothing. Lower the limits on a smaller host.
 #FLUXER_CADDY_MEMORY_LIMIT=256mb
 #FLUXER_POSTGRES_MEMORY_LIMIT=5gb
 #FLUXER_POSTGRES_MEMORY_RESERVATION=3gb
@@ -364,11 +358,10 @@ FLUXER_DISCOVERY_ENABLED=true
 #FLUXER_ERLANG_SCHEDULERS_MIN=2
 #FLUXER_ERLANG_SCHEDULERS_MAX=16
 
-# In-flight request ceiling for the four services Compose forwards it to: the
-# users and messages routers and their shards. Leave it unset and each service
-# uses its own built-in default, which is what the numbers below describe. Set it
-# and the one value replaces the built-in default on all four, so size it for the
-# busiest of them rather than for the smallest. The built-in defaults are 192 for
+# In-flight request ceiling for the services Compose forwards it to: the users
+# and messages routers and their shards. Leave it unset and each service uses its
+# built-in default. Set it and the one value replaces that default on all of
+# them, so size it for the busiest. The built-in defaults are 192 for
 # messages, 320 for snowflakes and 64 elsewhere, and they govern every service
 # Compose does not forward this to. A router holds a slot for the whole round
 # trip to its shard, so this is a ceiling on requests in flight at once and not a