#21: use a ClamAV image that exists for arm64

The deploy target is an Oracle Ampere host, and the default clamav/clamav
tag is Alpine-based and published for amd64 only - the deployment failed
pulling it with "no matching manifest for linux/arm64/v8".

The Debian variant of the same upstream image is built for amd64, arm64
and ppc64le and ships the same clamdcheck.sh the healthcheck uses.
Verified by pulling it, checking the manifest, and bringing the service up
healthy. Every other image in the stack was already multi-arch.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.yaml

@@ -104,7 +104,10 @@ services:
 
   # ------------------------------------------------------------ CLAMAV
   clamav:
-    image: clamav/clamav:1.4
+    # The Debian variant, not the default Alpine one: Alpine is published for
+    # amd64 only, and the deploy target is arm64. Same upstream project, same
+    # clamdcheck.sh healthcheck.
+    image: clamav/clamav:1.5.3-debian
     restart: *restart
     logging: *default-logging
     volumes: [clamav_data:/var/lib/clamav]