feat(immich): manifest-driven stack via orchestrator — live-migrated on .228

Completes the immich migration off the legacy hardcoded install_immich_stack
(podman run + sudo chown) to the registry-manifest + orchestrator path. Validated
live on .228 (clean single set, healthy v2.7.4, data dir ownership correct).

- install_immich_stack now tries install_stack_via_orchestrator(immich_stack_app_ids)
  first; legacy remains only as the no-manifests fallback.
- immich-{postgres,redis,server} manifests corrected from live findings:
  * named by app_id (dropped container_name override) — using container_name
    spawned DUPLICATE containers (app_id-named install vs name-override reconcile)
    on the same PGDATA, which corrupted a postgres cluster. Server reaches its
    siblings via app_id aliases (DB_HOSTNAME=immich-postgres, REDIS=immich-redis).
  * immich-postgres data_uid 100998:100998 (postgres drops to container 999 →
    host 100998 under rootless; verified the fresh dir is chowned correctly).
  * immich-server version "release"→"2.7.4" (manifest validation requires a digit;
    the bad version made the manifest silently skip → partial orchestrator install
    → legacy fallback → the duplicate corruption above).
- HARDEN install_stack_via_orchestrator: only fall back to the legacy installer
  when NOTHING was installed yet. An "unknown app_id" AFTER a member is up now
  errors instead of double-creating containers on shared data (the corruption
  root cause).
- Strict the all-manifests round-trip test: fail (not skip) on any invalid shipped
  manifest — this gap let the bad immich-server version through.

Known follow-up (pre-existing, platform-wide): orchestrator-installed backends
(immich, btcpay-db) run as podman --restart, not Quadlet, and podman-restart.service
is disabled on .228 → reboot-survival gap independent of this migration.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/immich-postgres/manifest.yml

@@ -4,15 +4,20 @@ app:
   version: "14-vectorchord0.4.3-pgvectors0.2.0"
   description: Postgres (pgvecto.rs / vectorchord) backend for Immich.
 
-  # The Immich server connects via DB_HOSTNAME=immich_postgres, so the container
-  # name (and thus its archy-net alias) must be the underscore form.
-  extensions:
-    container_name: immich_postgres
+  # No container_name override: the container is named by app_id (immich-postgres),
+  # which is also its archy-net alias and the server's DB_HOSTNAME. (Overriding the
+  # name diverges from the orchestrator's app_id-based naming and spawns duplicate
+  # containers — mirror the btcpay stack, which names members by app_id.)
 
   container:
     image: 146.59.87.168:3000/lfg2025/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0
     pull_policy: if-not-present
     network: archy-net
+    # postgres drops to its own uid (container 999 → host 100998 under rootless),
+    # so the data dir must be owned by that mapped uid — mirrors archy-btcpay-db.
+    # Verified on .228: the live immich-db is owned 100998. Without this a FRESH
+    # install's dir would be service-user-owned and postgres would EACCES.
+    data_uid: "100998:100998"
     generated_secrets:
       - name: immich-db-password
         kind: hex32

apps/immich-redis/manifest.yml

@@ -4,9 +4,7 @@ app:
   version: "7-alpine"
   description: Valkey (Redis-compatible) cache for Immich.
 
-  # Immich server connects via REDIS_HOSTNAME=immich_redis — alias must match.
-  extensions:
-    container_name: immich_redis
+  # Named by app_id (immich-redis) = archy-net alias = server's REDIS_HOSTNAME.
 
   container:
     image: 146.59.87.168:3000/lfg2025/valkey:7-alpine

apps/immich-server/manifest.yml

@@ -1,11 +1,11 @@
 app:
   id: immich-server
   name: Immich
-  version: "release"
+  version: "2.7.4"
   description: Self-hosted photo and video backup with mobile apps and search.
 
-  extensions:
-    container_name: immich_server
+  # Named by app_id (immich-server); connects to its siblings by their app_id
+  # aliases on archy-net (see DB_HOSTNAME / REDIS_HOSTNAME below).
 
   container:
     image: 146.59.87.168:3000/lfg2025/immich-server:release
@@ -41,10 +41,10 @@ app:
       options: [rw]
 
   environment:
-    - DB_HOSTNAME=immich_postgres
+    - DB_HOSTNAME=immich-postgres
     - DB_USERNAME=postgres
     - DB_DATABASE_NAME=immich
-    - REDIS_HOSTNAME=immich_redis
+    - REDIS_HOSTNAME=immich-redis
     - UPLOAD_LOCATION=/usr/src/app/upload
 
   health_check: