chore: upgrade to 1.7.0+v2.7.5

Confirms immich-server at the latest v2.7.5 + holds the DB pin immich v2.7.5 ships
(14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357), and adds a working postgres
backup/restore for the VectorChord DB (search_path rewrite per immich docs + a
local-trust pg_hba lockout, like matrix-synapse, so the app cannot race the reimport).

pg_backup.sh

@@ -1,29 +1,11 @@
 #!/bin/bash
 
-# Postgres backup/restore hook for the immich `database` service (VectorChord/pgvecto.rs image).
-# Invoked by backupbot-two via the deploy labels:
-#   backupbot.backup.pre-hook              = "/pg_backup.sh backup"
-#   backupbot.backup.volumes.postgres.path = "backup.sql"
-#   backupbot.restore.post-hook            = "/pg_backup.sh restore"
-#
-# Two image-specific constraints shape this hook, and BOTH are handled:
-#
-# 1. NEVER drop the database. immich's image bundles the legacy pgvecto.rs (`vectors`) extension whose
-#    background worker, if its database is dropped, recurses on its own IPC error until postgres aborts
-#    with `PANIC: ERRORDATA_STACK_SIZE exceeded` and crashes the whole server — after which immich can
-#    never reconnect. So we do NOT `DROP DATABASE`. Instead the backup is taken with
-#    `pg_dump --clean --if-exists`, so the dump itself carries a `DROP TABLE IF EXISTS` + recreate +
-#    copy for each object. Restoring it does a per-OBJECT replace inside the live database — stale rows
-#    added since the backup are removed (a true point-in-time restore, not a merge) — without ever
-#    dropping the database, so the pgvecto.rs worker is never destabilised. (Per-table DROP TABLE is
-#    fine; only DROP DATABASE triggers the PANIC.)
-#
-# 2. VectorChord search_path. A plain pg_dump emits
-#      SELECT pg_catalog.set_config('search_path', '', false);
-#    near the top; on reimport that empty search_path leaves the vector/vchord types + operator classes
-#    unresolvable. immich's documented restore (https://docs.immich.app/administration/backup-and-restore)
-#    rewrites that line to put `public, pg_catalog` back first — we do the same. ON_ERROR_STOP is left
-#    OFF so a benign hiccup on one object doesn't abort the whole import.
+# Postgres backup/restore hook for immich's VectorChord/pgvecto.rs `database` service.
+# Two image-specific constraints:
+#   1. Never DROP DATABASE — the bundled pgvecto.rs worker PANICs and crashes the server.
+#      So `pg_dump --clean --if-exists` does a per-object replace in the live DB on restore.
+#   2. Restore rewrites the dump's empty search_path back to `public, pg_catalog` so VectorChord
+#      types resolve (per https://docs.immich.app/administration/backup-and-restore).
 
 set -e