feat: attachments on tickets and comments

Files are uploaded over REST, stored on disk (a volume in Docker) and
recorded on the ticket as events; the bytes are written first, so no
attachment ever points at a missing file. Only images, video, audio, PDF
and plain text are shown inline, everything with nosniff and a sandbox CSP.
The web shows thumbnails, uploads by drag and drop or by pasting a
screenshot, and attaches files to new comments.

Also adds `nx run api:contracts`, which writes schema.gql and
openapi.json without starting the API or any database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/application/src/lib/commands/attach-file.command-handler.ts

@@ -0,0 +1,57 @@
+import { randomUUID } from 'node:crypto';
+import { CommandHandler, ICommandHandler } from '@nestjs/cqrs';
+import { BusinessRuleError } from '@task-stream/api/shared/domain';
+import { AttachmentStorage, attachmentKey } from '../ports/attachment-storage';
+import { AttachFileCommand } from './attach-file.command';
+import { CommandResult, ack } from './command-result';
+import { WriteAccess } from './write-access';
+
+/**
+ * Stores the bytes first and records them on the ticket after: a file with no
+ * record is cleaned up here, never a record with no file.
+ */
+@CommandHandler(AttachFileCommand)
+export class AttachFileCommandHandler
+  implements ICommandHandler<AttachFileCommand>
+{
+  constructor(
+    private readonly access: WriteAccess,
+    private readonly storage: AttachmentStorage,
+  ) {}
+
+  async execute(command: AttachFileCommand): Promise<CommandResult> {
+    const { issue } = await this.access.issueForContributor(
+      command.issueId,
+      command.actorId,
+    );
+    if (command.commentId) {
+      const comment = await this.access.comment(command.commentId);
+      if (comment.issueId !== issue.id) {
+        throw new BusinessRuleError(
+          `That comment belongs to another ticket, not ${issue.key}`,
+        );
+      }
+    }
+
+    const id = randomUUID();
+    const key = attachmentKey(issue.projectId, issue.id, id);
+    issue.attach(command.actorId, {
+      id,
+      fileName: command.file.fileName,
+      mimeType: command.file.mimeType,
+      size: command.file.content.length,
+      uploadedBy: command.actorId,
+      uploadedAt: new Date().toISOString(),
+      commentId: command.commentId,
+    });
+
+    await this.storage.put(key, command.file.content);
+    try {
+      await issue.commitAndWait();
+    } catch (error) {
+      await this.storage.remove(key);
+      throw error;
+    }
+    return ack(issue);
+  }
+}