immich: upgrade to v3.3.5 and chart 0.13.4

immich 3 drops pgvecto.rs, which the database no longer uses since the
move to PostgreSQL 17 with VectorChord 1.1.1 (supported range >=0.3 <2)
and pgvector 0.8.6 (>=0.7 <0.9). None of the removed environment
variables are set here. The mobile app cannot pass sol-auth, so there are
no app clients to upgrade first.

Charts after 0.12.0 are only published to the OCI registry. Since 0.13.0
the chart validates its values, and emptyDir volumes no longer accept
size, accessMode or storageClass; they did nothing anyway. Valkey follows
the chart's new default, 9.1.2. Each component now gets its own
ServiceAccount without a mounted token.

Safety net: Longhorn snapshot immich-pg17-pre-v3 and a pg_dump in
~/immich-pg17-pre-v3.dump on opti1, since immich cannot be downgraded.

immich/helm-immich.yaml

@@ -15,8 +15,10 @@ spec:
   project: default
   sources:
     - chart: immich
-      repoURL: https://immich-app.github.io/immich-charts
-      targetRevision: 0.10.3
+      # No scheme, so Argo CD pulls the chart from the OCI registry. Charts
+      # after 0.12.0 are only published there.
+      repoURL: ghcr.io/immich-app/immich-charts
+      targetRevision: 0.13.4
       helm:
         values: |
           controllers:
@@ -24,7 +26,7 @@ spec:
               containers:
                 main:
                   image:
-                    tag: v2.7.5
+                    tag: v3.3.5
                   env:
                     REDIS_HOSTNAME: '{{ printf "%s-valkey" .Release.Name }}'
                     IMMICH_MACHINE_LEARNING_URL: '{{ printf "http://%s-machine-learning:3003" .Release.Name }}'
@@ -69,16 +71,14 @@ spec:
                   main:
                     image:
                       repository: docker.io/valkey/valkey
-                      tag: 9.0-alpine@sha256:b4ee67d73e00393e712accc72cfd7003b87d0fcd63f0eba798b23251bfc9c394
+                      tag: 9.1.2-alpine@sha256:48332870af354a799964c0012ae1194a0bf2bf894eb508f945810596dc2d8d11
                       pullPolicy: IfNotPresent
             persistence:
               data:
                 enabled: true
-                size: 1Gi
-                # Optional: Set this to persistentVolumeClaim to keep job queues persistent
+                # Optional: to keep job queues persistent, use a
+                # persistentVolumeClaim with size, accessMode and storageClass
                 type: emptyDir
-                accessMode: ReadWriteOnce
-                storageClass: longhorn
 
           # Immich components
 
@@ -133,11 +133,9 @@ spec:
                     readOnly: true
               cache:
                 enabled: true
-                size: 10Gi
-                # Optional: Set this to persistentVolumeClaim to avoid downloading the ML models every start.
+                # Optional: to avoid downloading the ML models every start, use
+                # a persistentVolumeClaim with size, accessMode and storageClass
                 type: emptyDir
-                accessMode: ReadWriteMany
-                # storageClass: longhorn
 
   destination:
     server: https://kubernetes.default.svc