feat: attachments on tickets and comments

Files are uploaded over REST, stored on disk (a volume in Docker) and
recorded on the ticket as events; the bytes are written first, so no
attachment ever points at a missing file. Only images, video, audio, PDF
and plain text are shown inline, everything with nosniff and a sandbox CSP.
The web shows thumbnails, uploads by drag and drop or by pasting a
screenshot, and attaches files to new comments.

Also adds `nx run api:contracts`, which writes schema.gql and
openapi.json without starting the API or any database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/application/src/lib/queries/get-attachment.query.ts

@@ -0,0 +1,20 @@
+import { Query } from '@nestjs/cqrs';
+import { AttachmentReadModel } from '@task-stream/api/tracker/domain';
+import type { Readable } from 'node:stream';
+
+export interface AttachmentDownload {
+  attachment: AttachmentReadModel;
+  content: Readable;
+}
+
+/** A ticket's file, for whoever can read the ticket. */
+export class GetAttachmentQuery extends Query<AttachmentDownload> {
+  constructor(
+    /** Null: anonymous (public projects only). */
+    public readonly viewerId: string | null,
+    public readonly issueId: string,
+    public readonly attachmentId: string,
+  ) {
+    super();
+  }
+}