immich: add the service and import the ZimaOS library

jupiter had a leftover docker-compose Immich on the RAID (/mnt/data/Immich,
9.9G) that survived the NixOS install. Native module now, media at
/mnt/data/AppData/immich, caddy vhost on 2283 with a 50GB body limit
(caddy's default rejects video uploads).

The package comes from nixpkgs-unstable, the module from the 26.05 pin:
26.05 ships immich 2.7.5, but that database was last written by 3.0.0 and
migrations only run forward --

  corrupted migrations: previously executed migration
  1776217577402-DropAuditTable is missing

Safe because the two module files are byte-identical at these revisions;
services/media/immich.nix carries the diff command to re-check on a bump.
Drop the input once the stable pin ships >= 3.0.0.

immich needs group "users" only to traverse /mnt/data/AppData (drwx--x---);
its own dir stays 0700 immich:immich. mediaLocation is outside /var/lib, so
the module's tmpfiles entry only ADJUSTS it -- add a rule that creates it.

scripts/immich-import-legacy-db does the database half: boots a copy of the
legacy PGDATA under the matching image (PG14 + vchord 0.3.0 + pgvector
0.8.1), dumps it with the local pg_dump 17, restores into a scratch DB,
fixes ownership, and only swaps after confirmation. Never touches the
original. The old cluster ran VectorChord, not pgvecto.rs, so the smart
search and face embeddings survive -- no ML re-run.

Imported: 666 assets, 25 people, 647 clip + 359 face embeddings, 2 users.

hosts/jupiter/configuration.nix

@@ -20,6 +20,7 @@
     ../../services/media/radarr.nix
     ../../services/media/clonarr.nix
     ../../services/media/seerr.nix
+    ../../services/media/immich.nix
     ../../services/dev/gitea.nix
   ];
 
@@ -71,6 +72,14 @@
     "http://clonarr.jupiter.sol".extraConfig = "reverse_proxy localhost:6060";
     "http://seerr.jupiter.sol".extraConfig = "reverse_proxy localhost:5055";
     "http://gitea.jupiter.sol".extraConfig = "reverse_proxy localhost:3000";
+    # Immich uploads are large: raise the body limit off caddy's default and
+    # give slow phone uploads room before the proxy gives up.
+    "http://immich.jupiter.sol".extraConfig = ''
+      request_body {
+        max_size 50GB
+      }
+      reverse_proxy localhost:2283
+    '';
   };
 
   system.stateVersion = "26.05";