immich-server crash-looped on "permission denied to create extension vector" - pgvector's control file isn't marked trusted, and CNPG's app owner role isn't superuser (enableSuperuserAccess: false). Documents the fix for future cluster rebuilds; the live cluster already had CREATE EXTENSION run manually via the postgres pod's local socket.