immich: upgrade v2.7.5 → v3.0.0 (postgres → vectorchord 0.4.3, frames → immich_v3 tag)

Viktor asked to upgrade Immich to the just-released v3.0.0 (release notes,
migration guide and release discussion #29439 reviewed — no config-breaking
changes for this stack: we already use the split MACHINE_LEARNING_PRELOAD
vars, don't set DB_VECTOR_EXTENSION, OAuth goes through Authentik over
HTTPS, and the GPU node's CPU meets the new x86-64-v2 requirement).

The Immich Postgres image moves to VectorChord 0.4.3 to match the upstream
v3 reference stack (0.3.0 is still within v3's supported range '>=0.3 <2';
Immich upgrades the extension itself at startup). Both photo frames switch
to ImmichFrame's immich_v3 compatibility tag because every versioned
ImmichFrame release (≤ v1.0.33.0) crashes deserializing Immich v3 API
responses; repin to a versioned tag once upstream ships stable v3 support.

Deployment images are Keel-managed (KEEL_IGNORE_IMAGE, policy=patch), so
this commit is the source-of-truth record; the live rollout happens via
kubectl set image in the same session. Pre-upgrade pg_dumpall taken
(job postgresql-backup-pre-v3).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

stacks/immich/frame-emo.tf

@@ -73,7 +73,9 @@ resource "kubernetes_deployment" "immich-frame-emo" {
       }
       spec {
         container {
-          image = "ghcr.io/immichframe/immichframe:v1.0.32.0"
+          # immich_v3: upstream compat tag for Immich v3 — see frame.tf for the
+          # full story; repin to a versioned tag once upstream releases v3 support.
+          image = "ghcr.io/immichframe/immichframe:immich_v3"
           name  = "immich-frame-emo"
           resources {
             requests = {

stacks/immich/frame.tf

@@ -69,7 +69,11 @@ resource "kubernetes_deployment" "immich-frame" {
       }
       spec {
         container {
-          image = "ghcr.io/immichframe/immichframe:v1.0.32.0"
+          # immich_v3 is the upstream compat tag for Immich v3 servers — every
+          # versioned release (≤ v1.0.33.0) crashes deserializing v3 API
+          # responses (immichFrame/immichFrame#653). Pin back to a vX.Y.Z.W tag
+          # once a stable release ships v3 support (upstream PR #654).
+          image = "ghcr.io/immichframe/immichframe:immich_v3"
           name  = "immich-frame"
           resources {
             requests = {

stacks/immich/main.tf

@@ -15,7 +15,7 @@ locals {
 variable "immich_version" {
   type = string
   # Change me to upgrade
-  default = "v2.7.5"
+  default = "v3.0.0"
 }
 variable "proxmox_host" { type = string }
 variable "redis_host" { type = string }
@@ -492,7 +492,7 @@ resource "kubernetes_deployment" "immich-postgres" {
       }
       spec {
         container {
-          image = "ghcr.io/immich-app/postgres:15-vectorchord0.3.0-pgvectors0.2.0"
+          image = "ghcr.io/immich-app/postgres:15-vectorchord0.4.3-pgvectors0.2.0"
           name  = "immich-postgresql"
           port {
             container_port = 5432
@@ -882,7 +882,7 @@ resource "kubernetes_cron_job_v1" "clip-index-prewarm" {
             restart_policy = "Never"
             container {
               name  = "prewarm"
-              image = "ghcr.io/immich-app/postgres:15-vectorchord0.3.0-pgvectors0.2.0"
+              image = "ghcr.io/immich-app/postgres:15-vectorchord0.4.3-pgvectors0.2.0"
               # command overrides the postgres entrypoint → runs psql directly.
               command = [
                 "psql", "-v", "ON_ERROR_STOP=1", "-c",
@@ -964,7 +964,7 @@ resource "kubernetes_cron_job_v1" "immich-search-probe" {
             }
             init_container {
               name  = "measure"
-              image = "ghcr.io/immich-app/postgres:15-vectorchord0.3.0-pgvectors0.2.0"
+              image = "ghcr.io/immich-app/postgres:15-vectorchord0.4.3-pgvectors0.2.0"
               command = ["/bin/bash", "-c", <<-EOT
                 set -uo pipefail
                 OUT=/shared/metrics.prom