[IMMICH] Deploy Immich v3 photo server (Google Photos replacement)

- Compose stack at appdata/immich, exposed via Traefik at photos.xtrm-lab.org
- Library on cache NVMe (raidz1), Postgres on cache
- Nightly backup (DB dump + originals rsync) to parity-protected array disk1
- Google Takeout import ready via immich-go v0.32.0

docs/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 **Purpose:** Major infrastructure events only. Minor changes are in git commit messages.
 
+---
+## 2026-07-08
+
+### Immich deployed (Google Photos replacement)
+- **[IMMICH]** Deployed Immich v3.0.1 as a self-hosted Google Photos replacement — docker compose stack at `/mnt/user/appdata/immich/` (`IMMICH_VERSION=v3`), containers: immich_server, immich_machine_learning, immich_postgres (vectorchord), immich_redis
+- **[IMMICH]** Exposed via Traefik at `https://photos.xtrm-lab.org` (wildcard cert, no forward-auth so the mobile app works) + direct LAN `192.168.10.20:2283`. No new NAT rule (goes through existing 443→Traefik)
+- **[IMMICH]** Storage: primary library on cache NVMe pool `/mnt/user/photos` (raidz1, redundant, fast) — chosen over the array (single parity disk, ~900G free, slower). Postgres data on cache
+- **[IMMICH]** Backup: nightly 03:30 cron (`scripts/immich-backup.sh` via `dynamix/immich-backup.cron`) — pg_dumpall (keep 14) + originals rsync → `/mnt/disk1/immich-backup` (array disk1, parity-protected, independent media)
+- **[IMMICH]** Google Takeout import ready via immich-go v0.32.0 (`scripts/import-google-photos.sh`); import pending user's Takeout archive
+- **[NOTE]** Dropped the stock `/etc/localtime` bind mount (host symlink `→ Europe/Sofia/` with trailing slash breaks runc); use `TZ=Europe/Kyiv` instead
+
 ---
 ## 2026-06-30