feat(immich): upgrade to 3.x via unstable overlay

nixos-26.05 pins immich at 2.7.5; pull 3.2.0 from pkgs.unstable
instead. The machine-learning service picks up the matching version
automatically via the package's passthru. Verified jupiter's toplevel
still builds; pgvecto.rs->vectorchord migration was already in place
so no DB migration is needed for the bump itself.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DDyhS2N9XEeMq4GisBrqyf

modules/environments/immich/default.nix

@@ -18,6 +18,8 @@ in
   config = lib.mkIf cfg.enable {
     services.immich = {
       enable = true;
+      # nixos-26.05 pins immich 2.7.5; pull 3.x from the unstable overlay instead.
+      package = pkgs.unstable.immich;
       host = "0.0.0.0";
       inherit port;
       openFirewall = true;