feat: attachments on tickets and comments

Files are uploaded over REST, stored on disk (a volume in Docker) and
recorded on the ticket as events; the bytes are written first, so no
attachment ever points at a missing file. Only images, video, audio, PDF
and plain text are shown inline, everything with nosniff and a sandbox CSP.
The web shows thumbnails, uploads by drag and drop or by pasting a
screenshot, and attaches files to new comments.

Also adds `nx run api:contracts`, which writes schema.gql and
openapi.json without starting the API or any database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/application/src/lib/commands/detach-file.command-handler.ts

@@ -0,0 +1,35 @@
+import { CommandHandler, ICommandHandler } from '@nestjs/cqrs';
+import { ProjectRole } from '@task-stream/api/tracker/domain';
+import { AttachmentStorage, attachmentKey } from '../ports/attachment-storage';
+import { CommandResult, ack } from './command-result';
+import { DetachFileCommand } from './detach-file.command';
+import { WriteAccess } from './write-access';
+
+/** Removes the record first; the bytes go once nothing points at them. */
+@CommandHandler(DetachFileCommand)
+export class DetachFileCommandHandler
+  implements ICommandHandler<DetachFileCommand>
+{
+  constructor(
+    private readonly access: WriteAccess,
+    private readonly storage: AttachmentStorage,
+  ) {}
+
+  async execute(command: DetachFileCommand): Promise<CommandResult> {
+    const { issue, project } = await this.access.issueForContributor(
+      command.issueId,
+      command.actorId,
+    );
+    const role = project.roleOf(command.actorId);
+    issue.detach(
+      command.actorId,
+      command.attachmentId,
+      role === ProjectRole.OWNER || role === ProjectRole.ADMIN,
+    );
+    await issue.commitAndWait();
+    await this.storage.remove(
+      attachmentKey(issue.projectId, issue.id, command.attachmentId),
+    );
+    return ack(issue);
+  }
+}