cleanup: comments in capabilities modules, default capabilities.toml, login

programs/data/config/capabilities.toml

@@ -5,16 +5,6 @@
 # storage_admin, raw_storage, network_admin, set_time, user_admin,
 # display_admin, device_admin, log_read, system_image, compositor and "all".
 #
-# `effective` is what the program itself may use; `delegable` is what it may
-# pass on to programs it launches. The two are independent, and both are
-# clamped by the kernel to what the launcher can delegate.
-#
-# A grant only applies to a program under 0:/os or 0:/apps. Anything else can
-# be replaced by any process, so the kernel starts it with no capabilities.
-#
-# A program with no grant here can still ask for storage_admin, network_admin,
-# set_time, display_admin or log_read the first time it needs one: the desktop
-# prompts, and the answer is stored in 0:/config/consent.toml (docs/consent.md).
 
 # ==== System services (started by init) ====