feat: attachments on tickets and comments

Files are uploaded over REST, stored on disk (a volume in Docker) and
recorded on the ticket as events; the bytes are written first, so no
attachment ever points at a missing file. Only images, video, audio, PDF
and plain text are shown inline, everything with nosniff and a sandbox CSP.
The web shows thumbnails, uploads by drag and drop or by pasting a
screenshot, and attaches files to new comments.

Also adds `nx run api:contracts`, which writes schema.gql and
openapi.json without starting the API or any database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/api/schema.gql

@@ -25,6 +25,22 @@ input AreaOptionInput {
   name: String!
 }
 
+"""
+A file on a ticket. Download it from the REST API: GET /api/issues/{issueId}/attachments/{id}
+"""
+type Attachment {
+  """The comment it was attached to, if any"""
+  commentId: ID
+  fileName: String!
+  id: ID!
+  mimeType: String!
+
+  """Bytes"""
+  size: Int!
+  uploadedAt: String!
+  uploadedBy: UserRef!
+}
+
 type BoardColumn {
   issues: [Issue!]!
   status: String!
@@ -168,6 +184,7 @@ type Issue {
   """An area id"""
   area: String
   assignee: UserRef
+  attachments: [Attachment!]!
   commentCount: Int!
   comments(limit: Int! = 50, offset: Int! = 0): CommentPage!
   createdAt: String!
@@ -329,6 +346,11 @@ type Mutation {
   Ship the release. Fails while it has unfinished tickets unless force = true.
   """
   publishRelease(force: Boolean! = false, releaseId: ID!): CommandResult!
+
+  """
+  Remove a file from a ticket (whoever uploaded it, or an owner/admin). Upload with the REST API.
+  """
+  removeAttachment(attachmentId: ID!, issueId: ID!): CommandResult!
   removeProjectMember(projectId: ID!, userId: ID!): CommandResult!
 
   """Put a ticket in a release (null removes it)"""