feat: attachments on tickets and comments

Files are uploaded over REST, stored on disk (a volume in Docker) and
recorded on the ticket as events; the bytes are written first, so no
attachment ever points at a missing file. Only images, video, audio, PDF
and plain text are shown inline, everything with nosniff and a sandbox CSP.
The web shows thumbnails, uploads by drag and drop or by pasting a
screenshot, and attaches files to new comments.

Also adds `nx run api:contracts`, which writes schema.gql and
openapi.json without starting the API or any database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/application/src/lib/issues.service.ts

@@ -7,6 +7,11 @@ import {
   IssueReadModel,
 } from '@task-stream/api/tracker/domain';
 import { AssignIssueCommand } from './commands/assign-issue.command';
+import {
+  AttachFileCommand,
+  IncomingFile,
+} from './commands/attach-file.command';
+import { DetachFileCommand } from './commands/detach-file.command';
 import { ChangeIssueStatusCommand } from './commands/change-issue-status.command';
 import { CommandResult } from './commands/command-result';
 import { CreateIssueCommand } from './commands/create-issue.command';
@@ -16,6 +21,10 @@ import { UnlinkIssuesCommand } from './commands/unlink-issues.command';
 import { UpdateIssueCommand } from './commands/update-issue.command';
 import { IssueFilter, Page } from './ports/find-issues.repository';
 import { GetActivityQuery } from './queries/get-activity.query';
+import {
+  AttachmentDownload,
+  GetAttachmentQuery,
+} from './queries/get-attachment.query';
 import { GetIssueQuery } from './queries/get-issue.query';
 import { GetIssuesByIdsQuery } from './queries/get-issues-by-ids.query';
 import { SearchIssuesQuery } from './queries/search-issues.query';
@@ -126,6 +135,39 @@ export class IssuesService {
     );
   }
 
+  /** Attaches a file to the ticket, or to one of its comments. */
+  attach(
+    actorId: string,
+    issueId: string,
+    file: IncomingFile,
+    commentId: string | null = null,
+  ): Promise<CommandResult> {
+    return this.commandBus.execute(
+      new AttachFileCommand(actorId, issueId, file, commentId),
+    );
+  }
+
+  detach(
+    actorId: string,
+    issueId: string,
+    attachmentId: string,
+  ): Promise<CommandResult> {
+    return this.commandBus.execute(
+      new DetachFileCommand(actorId, issueId, attachmentId),
+    );
+  }
+
+  /** A ticket's file, with its bytes, for whoever can read the ticket. */
+  download(
+    viewerId: string | null,
+    issueId: string,
+    attachmentId: string,
+  ): Promise<AttachmentDownload> {
+    return this.queryBus.execute(
+      new GetAttachmentQuery(viewerId, issueId, attachmentId),
+    );
+  }
+
   findOne(viewerId: string | null, idOrKey: string): Promise<IssueReadModel> {
     return this.queryBus.execute(new GetIssueQuery(viewerId, idOrKey));
   }