feat: attachments on tickets and comments

Files are uploaded over REST, stored on disk (a volume in Docker) and
recorded on the ticket as events; the bytes are written first, so no
attachment ever points at a missing file. Only images, video, audio, PDF
and plain text are shown inline, everything with nosniff and a sandbox CSP.
The web shows thumbnails, uploads by drag and drop or by pasting a
screenshot, and attaches files to new comments.

Also adds `nx run api:contracts`, which writes schema.gql and
openapi.json without starting the API or any database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/application/src/lib/queries/get-attachment.query-handler.ts

@@ -0,0 +1,39 @@
+import { IQueryHandler, QueryHandler } from '@nestjs/cqrs';
+import { NotFoundError } from '@task-stream/api/shared/domain';
+import { AttachmentStorage, attachmentKey } from '../ports/attachment-storage';
+import { FindIssuesRepository } from '../ports/find-issues.repository';
+import { AttachmentDownload, GetAttachmentQuery } from './get-attachment.query';
+import { ReadAccess } from './read-access';
+
+@QueryHandler(GetAttachmentQuery)
+export class GetAttachmentQueryHandler
+  implements IQueryHandler<GetAttachmentQuery, AttachmentDownload>
+{
+  constructor(
+    private readonly findIssues: FindIssuesRepository,
+    private readonly storage: AttachmentStorage,
+    private readonly access: ReadAccess,
+  ) {}
+
+  async execute(query: GetAttachmentQuery): Promise<AttachmentDownload> {
+    const issue = this.access.assertFound(
+      await this.findIssues.findById(query.issueId),
+      'Attachment',
+      query.attachmentId,
+    );
+    await this.access.assertCanView(issue.projectId, query.viewerId, {
+      entity: 'Attachment',
+      ref: query.attachmentId,
+    });
+    const attachment = (issue.attachments ?? []).find(
+      (a) => a.id === query.attachmentId,
+    );
+    if (!attachment) throw new NotFoundError('Attachment', query.attachmentId);
+    return {
+      attachment,
+      content: await this.storage.read(
+        attachmentKey(issue.projectId, issue.id, attachment.id),
+      ),
+    };
+  }
+}