Pin Paperless-ngx to 2.20.15 on the way to v3

v3 can only be reached from 2.20.15, so stop tracking :latest. Also set
the two settings v3 needs from us: trust Caddy as the proxy (v3's login
rate limiting), and keep rejecting duplicate documents.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

group_vars/docker/services.yml

@@ -28,3 +28,6 @@ starpunk_admin_sub: "5754855f-0a30-4755-9609-7294209e40f4"
 
 # Gokapi super admin: must match the Pocket ID account email
 gokapi_admin_email: "phil@{{ primary_domain }}"
+
+# Paperless-ngx image tag. v3 can only be reached from 2.20.15.
+paperless_version: "2.20.15"

roles/docker/templates/paperlessngx-compose.yml.j2

@@ -6,7 +6,9 @@ services:
       - redisdata:/data
 
   webserver:
-    image: ghcr.io/paperless-ngx/paperless-ngx:latest
+    # Pinned: major versions need care (v3 could only be reached from
+    # 2.20.15). Bump deliberately after reading the release notes.
+    image: ghcr.io/paperless-ngx/paperless-ngx:{{ paperless_version }}
     restart: unless-stopped
     labels:
       # Stop during backup so the SQLite database in the data volume is consistent
@@ -29,6 +31,10 @@ services:
       PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
       PAPERLESS_TIKA_ENDPOINT: http://tika:9998
       PAPERLESS_OCR_USER_ARGS: '{"invalidate_digital_signatures": true}'
+      # Caddy. v3's login rate limiting reads the client IP from it.
+      PAPERLESS_TRUSTED_PROXIES: "{{ docker.hairpin_ip }}"
+      # v3 accepts duplicates by default; keep rejecting them.
+      PAPERLESS_CONSUMER_DELETE_DUPLICATES: "true"
 
   gotenberg:
     image: docker.io/gotenberg/gotenberg:8.39.0