fixes and improvements

.env.example

@@ -15,14 +15,8 @@ SMTP_TIMEOUT=30
 # Machine/service configuration now lives in the app's Settings tab.
 # The built-in local machine is seeded automatically.
 #
-# For a remote SSH machine, the backend still needs access to a private key
-# file. Compose mounts a single host key file as a Docker secret instead of the
-# whole ~/.ssh directory.
-#
-# Host-side path used by Docker Compose secret definitions:
-SSH_KEY_HOST_PATH=/absolute/path/to/id_ed25519
-# The container-side path is fixed by the app and Compose at:
-# /run/secrets/ssh_private_key
+# Remote SSH machines can store their private key and optional passphrase directly in Settings,
+# so no SSH key mount is required for normal use.
 
 # For deployment with traefik
 FRONTEND_APP_NAME=manage