upstream(immich): v3.2.0 pins (valkey 70739f85, pg combo unchanged) + ghcr pagination gotcha

cc-ci-plan/upstream/immich.md

@@ -50,6 +50,24 @@
   Immich is now **up-to-date** (v3.1.0 is latest stable per GitHub releases; no v3.1.x patch / v3.2.x).
   PR #4 now diverges from upstream main only on `database` (pgvectors0.3.0 vs 0.2.0) + `redis`
   (valkey:9@8e8d64b4 vs @3acc0687) pins — operator decides merge-vs-close.
+- **immich-server v3.2.0 (2026-09-10) pins** (from its `docker/docker-compose.yml` at the v3.2.0 tag):
+  `valkey:9@sha256:70739f85ad2ee01a726a965584a0f94895f01b0c60b3cc8b0aeef11eaa6888cf`
+  (= valkey **9.1.1** per image env; a NEWER build than v3.1.0's `8e8d64b4…` = 9.1.0 — but OLDER
+  than the live `9` tag, which by 2026-09-11 moved to `c123e371…` = 9.1.2; pin immich's tested
+  `70739f85…`, NOT the live tag, per the 2026-07-17 precedent) and
+  `postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357…` (SAME combo as v3.1.0 — DB
+  unchanged). No breaking server-side changes in v3.2.0; `example.env` byte-identical to v3.1.0;
+  TypeORM migrations auto-run. Operator-info only: the new opt-in cluster-groups feature requires
+  a per-group facial-recognition reset (user-triggered button, not a deploy migration). **ghcr
+  pagination gotcha (hit 2026-09-11):** `ghcr.io/v2/immich-app/postgres/tags/list` pages are ~100
+  tags, NOT purely lexicographic, and the `Link:` header returns a RELATIVE url (`/v2/...`) —
+  prefix the host or pagination silently stops at page 1; the pinned pg tag `14-vectorchord0.4.3-
+  pgvectors0.2.0` is on **page 2** of 174 (a first-page probe wrongly suggests it's gone). Upstream
+  coopcloud has open renovate PRs #18 (v3.2.0 monorepo bump = server+ML only), #17 (valkey digest
+  → live c123e37 — not immich's tested pin), #16 (postgres → pg16 — unsupported by immich v3.2.0,
+  reject). Done in the 2026-09-11 upgrade (v3.1.0→v3.2.0, extending PR #4 from upstream main
+  794560f; PR #4's pgvectors0.3.0/valkey-8e8d64b4 divergences superseded — DB realigned to
+  immich's official combo, which upstream main itself chose 2026-08-07).
 - **2026-08-07 INFRA note: cc-ci runner's gitea clone-token is STALE (HTTP 401).** `!testme` build
   #1210 died at the recipe `git clone` step (~5s, before any deploy) with `could not read Username for
   'https://git.autonomic.zone'` — the runner's mounted gitea token `13e299f2…` is rejected (verified