feat(2): Q3.5 immich enrollment (recipe_meta + ops + lifecycle overlays + health parity)

immich (object-storage/large-volume photo mgmt; D10 category): 3 services (app incl. ML + web, redis,
database/postgres), self-contained (no SSO dep — local admin; OIDC optional). recipe_meta (HTTP health,
DEPLOY_TIMEOUT=1500), ops.py postgres ci_marker (postgres/immich, backupbot-labelled), lifecycle
overlays, health_check parity. §4.3 upload-asset→list→thumbnail test next (after live-API discovery).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/immich/recipe_meta.py

@@ -0,0 +1,12 @@
+# Per-recipe harness config for immich (Phase 2 Q3.5 — object-storage / large-volume photo+video
+# management; a D10 category). Self-contained: app (immich-server, incl. machine-learning + the
+# web SPA) + redis + database (postgres). NO external SSO dep needed — immich boots with a local
+# admin account (OIDC is optional and NOT in the base .env.sample), so the §4.3 functional test uses
+# immich's own admin API, not an OIDC provider. (oidc_login parity is authentik-specific in the
+# corpus; per the operator SSO policy keycloak is the default and immich OIDC is optional — see
+# PARITY.md non-ports.)
+HEALTH_PATH = "/"
+HEALTH_OK = (200, 301, 302)
+# immich-server boots the API + web + (first-run) machine-learning model fetch; allow a wide window.
+DEPLOY_TIMEOUT = 1500
+HTTP_TIMEOUT = 600