feat: attachments on tickets and comments

Files are uploaded over REST, stored on disk (a volume in Docker) and
recorded on the ticket as events; the bytes are written first, so no
attachment ever points at a missing file. Only images, video, audio, PDF
and plain text are shown inline, everything with nosniff and a sandbox CSP.
The web shows thumbnails, uploads by drag and drop or by pasting a
screenshot, and attaches files to new comments.

Also adds `nx run api:contracts`, which writes schema.gql and
openapi.json without starting the API or any database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/application/src/lib/queries/get-attachment.query-handler.ts

@@ -0,0 +1,39 @@
+import { IQueryHandler, QueryHandler } from '@nestjs/cqrs';
+import { NotFoundError } from '@task-stream/api/shared/domain';
+import { AttachmentStorage, attachmentKey } from '../ports/attachment-storage';
+import { FindIssuesRepository } from '../ports/find-issues.repository';
+import { AttachmentDownload, GetAttachmentQuery } from './get-attachment.query';
+import { ReadAccess } from './read-access';
+
+@QueryHandler(GetAttachmentQuery)
+export class GetAttachmentQueryHandler
+  implements IQueryHandler<GetAttachmentQuery, AttachmentDownload>
+{
+  constructor(
+    private readonly findIssues: FindIssuesRepository,
+    private readonly storage: AttachmentStorage,
+    private readonly access: ReadAccess,
+  ) {}
+
+  async execute(query: GetAttachmentQuery): Promise<AttachmentDownload> {
+    const issue = this.access.assertFound(
+      await this.findIssues.findById(query.issueId),
+      'Attachment',
+      query.attachmentId,
+    );
+    await this.access.assertCanView(issue.projectId, query.viewerId, {
+      entity: 'Attachment',
+      ref: query.attachmentId,
+    });
+    const attachment = (issue.attachments ?? []).find(
+      (a) => a.id === query.attachmentId,
+    );
+    if (!attachment) throw new NotFoundError('Attachment', query.attachmentId);
+    return {
+      attachment,
+      content: await this.storage.read(
+        attachmentKey(issue.projectId, issue.id, attachment.id),
+      ),
+    };
+  }
+}

libs/api/tracker/application/src/lib/queries/get-attachment.query.ts

@@ -0,0 +1,20 @@
+import { Query } from '@nestjs/cqrs';
+import { AttachmentReadModel } from '@task-stream/api/tracker/domain';
+import type { Readable } from 'node:stream';
+
+export interface AttachmentDownload {
+  attachment: AttachmentReadModel;
+  content: Readable;
+}
+
+/** A ticket's file, for whoever can read the ticket. */
+export class GetAttachmentQuery extends Query<AttachmentDownload> {
+  constructor(
+    /** Null: anonymous (public projects only). */
+    public readonly viewerId: string | null,
+    public readonly issueId: string,
+    public readonly attachmentId: string,
+  ) {
+    super();
+  }
+}

libs/api/tracker/application/src/lib/queries/index.ts

@@ -16,3 +16,4 @@ export * from './get-upcoming-releases.query';
 export * from './search-issues.query';
 export * from './search-my-issues.query';
 export * from './get-public-projects.query';
+export * from './get-attachment.query';

libs/api/tracker/application/src/lib/queries/query-handlers.ts

@@ -1,3 +1,4 @@
+import { GetAttachmentQueryHandler } from './get-attachment.query-handler';
 import { GetPublicProjectsQueryHandler } from './get-public-projects.query-handler';
 import { CanViewProjectQueryHandler } from './can-view-project.query-handler';
 import { GetActivityQueryHandler } from './get-activity.query-handler';
@@ -36,4 +37,5 @@ export const QUERY_HANDLERS = [
   GetUpcomingReleasesQueryHandler,
   SearchIssuesQueryHandler,
   SearchMyIssuesQueryHandler,
+  GetAttachmentQueryHandler,
 ];