feat: attachments on tickets and comments

Files are uploaded over REST, stored on disk (a volume in Docker) and
recorded on the ticket as events; the bytes are written first, so no
attachment ever points at a missing file. Only images, video, audio, PDF
and plain text are shown inline, everything with nosniff and a sandbox CSP.
The web shows thumbnails, uploads by drag and drop or by pasting a
screenshot, and attaches files to new comments.

Also adds `nx run api:contracts`, which writes schema.gql and
openapi.json without starting the API or any database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/infrastructure/src/lib/mongo/upsert-materialized.repositories.ts

@@ -10,6 +10,7 @@ import {
 } from '@task-stream/api/tracker/application';
 import {
   ActivityReadModel,
+  AttachmentReadModel,
   CommentReadModel,
   IssueLinkReadModel,
   IssueReadModel,
@@ -99,14 +100,29 @@ export class MongoUpsertMaterializedIssueRepository extends UpsertMaterializedIs
     version,
     ...fields
   }: Pick<IssueReadModel, 'id' | 'version'> &
-    Partial<Omit<IssueReadModel, 'links' | 'commentCount'>>) {
+    Partial<Omit<IssueReadModel, 'links' | 'commentCount' | 'attachments'>>) {
     await upsertIfNewer(this.issues, id, version, fields, {
       outwardLinks: [],
       inwardLinks: [],
+      attachments: [],
       commentCount: 0,
     });
   }
 
+  async addAttachment(issueId: string, attachment: AttachmentReadModel) {
+    await this.issues.updateOne(
+      { _id: issueId, 'attachments.id': { $ne: attachment.id } },
+      { $push: { attachments: attachment } },
+    );
+  }
+
+  async removeAttachment(issueId: string, attachmentId: string) {
+    await this.issues.updateOne(
+      { _id: issueId },
+      { $pull: { attachments: { id: attachmentId } } },
+    );
+  }
+
   async addLink(issueId: string, link: IssueLinkReadModel) {
     const field = link.direction === 'OUTWARD' ? 'outwardLinks' : 'inwardLinks';
     await this.issues.updateOne(