chore: upgrade to 1.7.0+v2.7.5

Confirms immich-server at the latest v2.7.5 + holds the DB pin immich v2.7.5 ships
(14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357), and adds a working postgres
backup/restore for the VectorChord DB (search_path rewrite per immich docs + a
local-trust pg_hba lockout, like matrix-synapse, so the app cannot race the reimport).

pg_backup.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+
+# Postgres backup/restore hook for immich's VectorChord/pgvecto.rs `database` service.
+# Two image-specific constraints:
+#   1. Never DROP DATABASE — the bundled pgvecto.rs worker PANICs and crashes the server.
+#      So `pg_dump --clean --if-exists` does a per-object replace in the live DB on restore.
+#   2. Restore rewrites the dump's empty search_path back to `public, pg_catalog` so VectorChord
+#      types resolve (per https://docs.immich.app/administration/backup-and-restore).
+
+set -e
+
+BACKUP_FILE='/var/lib/postgresql/data/backup.sql'
+export PGPASSWORD=$(cat "${POSTGRES_PASSWORD_FILE:-/run/secrets/db_password}")
+DB_USER="${POSTGRES_USER:-postgres}"
+DB_NAME="${POSTGRES_DB:-immich}"
+
+function backup {
+  pg_dump --clean --if-exists -U "$DB_USER" "$DB_NAME" | gzip > "$BACKUP_FILE"
+}
+
+function restore {
+  gunzip -c "$BACKUP_FILE" \
+    | sed "s/SELECT pg_catalog.set_config('search_path', '', false);/SELECT pg_catalog.set_config('search_path', 'public, pg_catalog', true);/g" \
+    | psql -U "$DB_USER" -d "$DB_NAME" -f -
+}
+
+$@