feat: attachments on tickets and comments

Files are uploaded over REST, stored on disk (a volume in Docker) and
recorded on the ticket as events; the bytes are written first, so no
attachment ever points at a missing file. Only images, video, audio, PDF
and plain text are shown inline, everything with nosniff and a sandbox CSP.
The web shows thumbnails, uploads by drag and drop or by pasting a
screenshot, and attaches files to new comments.

Also adds `nx run api:contracts`, which writes schema.gql and
openapi.json without starting the API or any database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/infrastructure/src/lib/mongo/read-model.schemas.ts

@@ -69,6 +69,18 @@ export const IssueSchema = new Schema<IssueDoc>(
     release: { _id: false, id: String, name: String },
     outwardLinks: [link],
     inwardLinks: [link],
+    attachments: [
+      {
+        _id: false,
+        id: String,
+        fileName: String,
+        mimeType: String,
+        size: Number,
+        uploadedBy: userRef,
+        uploadedAt: String,
+        commentId: String,
+      },
+    ],
     labels: [String],
     version: Number,
   },
@@ -137,5 +149,7 @@ export function issueFromDoc(doc: IssueDoc): IssueReadModel {
     id: _id,
     ...rest,
     links: [...(outwardLinks ?? []), ...(inwardLinks ?? [])],
+    // Tickets projected before attachments existed have none.
+    attachments: rest.attachments ?? [],
   };
 }