You should consider opnsense instead of pfsense in any case.

If by app you mean container, no. You pull the latest image and rerun docker compose. It will make only the necessary changes, in this case restarting the container to update.

https://xkcd.com/1897/

For a generous definition of “original”.

Edit: very generous, since it’s just new text on the second panel in https://xkcd.com/1269/