feat: attachments on tickets and comments

Files are uploaded over REST, stored on disk (a volume in Docker) and
recorded on the ticket as events; the bytes are written first, so no
attachment ever points at a missing file. Only images, video, audio, PDF
and plain text are shown inline, everything with nosniff and a sandbox CSP.
The web shows thumbnails, uploads by drag and drop or by pasting a
screenshot, and attaches files to new comments.

Also adds `nx run api:contracts`, which writes schema.gql and
openapi.json without starting the API or any database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/infrastructure/src/lib/mongo/read-model.schemas.ts

@@ -69,6 +69,18 @@ export const IssueSchema = new Schema<IssueDoc>(
     release: { _id: false, id: String, name: String },
     outwardLinks: [link],
     inwardLinks: [link],
+    attachments: [
+      {
+        _id: false,
+        id: String,
+        fileName: String,
+        mimeType: String,
+        size: Number,
+        uploadedBy: userRef,
+        uploadedAt: String,
+        commentId: String,
+      },
+    ],
     labels: [String],
     version: Number,
   },
@@ -137,5 +149,7 @@ export function issueFromDoc(doc: IssueDoc): IssueReadModel {
     id: _id,
     ...rest,
     links: [...(outwardLinks ?? []), ...(inwardLinks ?? [])],
+    // Tickets projected before attachments existed have none.
+    attachments: rest.attachments ?? [],
   };
 }

libs/api/tracker/infrastructure/src/lib/mongo/upsert-materialized.repositories.ts

@@ -10,6 +10,7 @@ import {
 } from '@task-stream/api/tracker/application';
 import {
   ActivityReadModel,
+  AttachmentReadModel,
   CommentReadModel,
   IssueLinkReadModel,
   IssueReadModel,
@@ -99,14 +100,29 @@ export class MongoUpsertMaterializedIssueRepository extends UpsertMaterializedIs
     version,
     ...fields
   }: Pick<IssueReadModel, 'id' | 'version'> &
-    Partial<Omit<IssueReadModel, 'links' | 'commentCount'>>) {
+    Partial<Omit<IssueReadModel, 'links' | 'commentCount' | 'attachments'>>) {
     await upsertIfNewer(this.issues, id, version, fields, {
       outwardLinks: [],
       inwardLinks: [],
+      attachments: [],
       commentCount: 0,
     });
   }
 
+  async addAttachment(issueId: string, attachment: AttachmentReadModel) {
+    await this.issues.updateOne(
+      { _id: issueId, 'attachments.id': { $ne: attachment.id } },
+      { $push: { attachments: attachment } },
+    );
+  }
+
+  async removeAttachment(issueId: string, attachmentId: string) {
+    await this.issues.updateOne(
+      { _id: issueId },
+      { $pull: { attachments: { id: attachmentId } } },
+    );
+  }
+
   async addLink(issueId: string, link: IssueLinkReadModel) {
     const field = link.direction === 'OUTWARD' ? 'outwardLinks' : 'inwardLinks';
     await this.issues.updateOne(