Update Karakeep's browser and search, and Gotenberg

Karakeep's Chrome was alpine-chrome 123 (April 2024) and it opens every
bookmarked URL; it now uses Karakeep's own Chrome image like upstream.
Meilisearch goes from 1.13.3 to 1.41.0 with a dumpless in-place upgrade.
Gotenberg for Paperless goes from 8.7 to 8.39.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/templates/hoarder-compose.yml.j2

@@ -17,19 +17,23 @@ services:
     labels:
       mag37.dockcheck.update: true
   chrome:
-    image: gcr.io/zenika-hub/alpine-chrome:123
+    # Karakeep's own Chrome build (upstream compose). It opens every
+    # bookmarked URL, so keep it current.
+    image: ghcr.io/karakeep-app/karakeep-chrome:release
     restart: unless-stopped
+    init: true
     labels:
       mag37.dockcheck.update: true
     command:
-      - --no-sandbox
       - --disable-gpu
       - --disable-dev-shm-usage
-      - --remote-debugging-address=0.0.0.0
-      - --remote-debugging-port=9222
       - --hide-scrollbars
+      - --disable-blink-features=AutomationControlled
+      - --window-size=1440,900
   meilisearch:
-    image: getmeili/meilisearch:v1.13.3
+    # Pinned like upstream: Meilisearch upgrades rewrite the index. The
+    # dumpless upgrade flag lets a newer version convert it in place.
+    image: getmeili/meilisearch:v1.41.0
     restart: unless-stopped
     labels:
       mag37.dockcheck.update: true
@@ -37,6 +41,7 @@ services:
       - .env
     environment:
       MEILI_NO_ANALYTICS: "true"
+      MEILI_EXPERIMENTAL_DUMPLESS_UPGRADE: "true"
     volumes:
       - meilisearch:/meili_data
 volumes:

roles/docker/templates/paperlessngx-compose.yml.j2

@@ -31,7 +31,7 @@ services:
       PAPERLESS_OCR_USER_ARGS: '{"invalidate_digital_signatures": true}'
 
   gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.7
+    image: docker.io/gotenberg/gotenberg:8.39.0
     restart: unless-stopped
 
     # The gotenberg chromium route is used to convert .eml files. We do not