pin filebrowser, couchdb, statping to explicit versions instead of floating beta/dev/untagged

Same category of risk as the gitea :nightly issue: floating dev/beta tags
let watchtower silently pull unvetted upstream builds. couchdb had no tag
at all (implicit :latest); filebrowser and statping only publish
beta/dev channels upstream so pinned to the exact version in use rather
than a moving target.

couchdb/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   couchserver:
-    image: couchdb
+    image: couchdb:3.5
     container_name: couchdb
     restart: always
     labels:

filebrowser-colleen-hd/docker-compose.yml

@@ -1,7 +1,10 @@
 services:
   filebrowser:
     container_name: filebrowser-colleen-hd
-    image: gtstef/filebrowser:beta
+    # No stable channel exists upstream for this project (only beta/preview
+    # tags are published) — pinned to the exact version in use instead of the
+    # floating :beta tag so watchtower can't silently jump versions.
+    image: gtstef/filebrowser:1.5.4-beta
     environment:
       FILEBROWSER_CONFIG: "data/config.yaml"
       TZ: "America/New_York"

statping/docker-compose.yml

@@ -1,7 +1,11 @@
 services:
   statping:
     container_name: statping
-    image: statping/statping:dev
+    # statping upstream is abandoned (no pushes in 5+ years); pinned to the
+    # last tagged stable release instead of the floating :dev tag. Not
+    # currently deployed (no running container) — worth reconsidering
+    # whether this service is needed at all before ever starting it.
+    image: statping/statping:v0.90.74
     restart: always
     volumes:
       - /srv/statping-data:/app