feat: attachments on tickets and comments

Files are uploaded over REST, stored on disk (a volume in Docker) and
recorded on the ticket as events; the bytes are written first, so no
attachment ever points at a missing file. Only images, video, audio, PDF
and plain text are shown inline, everything with nosniff and a sandbox CSP.
The web shows thumbnails, uploads by drag and drop or by pasting a
screenshot, and attaches files to new comments.

Also adds `nx run api:contracts`, which writes schema.gql and
openapi.json without starting the API or any database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/domain/src/lib/read-models/issue.read-model.ts

@@ -12,6 +12,17 @@ export class IssueLinkReadModel {
   issueKey!: string;
 }
 
+export class AttachmentReadModel {
+  id!: string;
+  fileName!: string;
+  mimeType!: string;
+  size!: number;
+  uploadedBy!: UserRefReadModel;
+  uploadedAt!: string;
+  /** Shown under this comment when set. */
+  commentId!: string | null;
+}
+
 export class IssueReadModel {
   id!: string;
   projectId!: string;
@@ -35,6 +46,7 @@ export class IssueReadModel {
   storyPoints!: number | null;
   dueDate!: string | null;
   links!: IssueLinkReadModel[];
+  attachments!: AttachmentReadModel[];
   commentCount!: number;
   createdAt!: string;
   updatedAt!: string;