feat: attachments on tickets and comments

Files are uploaded over REST, stored on disk (a volume in Docker) and
recorded on the ticket as events; the bytes are written first, so no
attachment ever points at a missing file. Only images, video, audio, PDF
and plain text are shown inline, everything with nosniff and a sandbox CSP.
The web shows thumbnails, uploads by drag and drop or by pasting a
screenshot, and attaches files to new comments.

Also adds `nx run api:contracts`, which writes schema.gql and
openapi.json without starting the API or any database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -56,6 +56,11 @@ services:
       # document is still served at /api/docs-json.
       GRAPHQL_SCHEMA_FILE: ''
       OPENAPI_FILE: ''
+      ATTACHMENTS_DIR: /data/attachments
+      ATTACHMENTS_MAX_MB: ${ATTACHMENTS_MAX_MB:-25}
+    volumes:
+      # Files attached to tickets: lose this volume and the tickets point at nothing.
+      - attachments-data:/data/attachments
     depends_on:
       postgres: { condition: service_healthy }
       mongo: { condition: service_healthy }
@@ -125,6 +130,7 @@ services:
       retries: 10
 
 volumes:
+  attachments-data:
   postgres-data:
   mongo-data:
   redis-data: