feat: attachments on tickets and comments

Files are uploaded over REST, stored on disk (a volume in Docker) and
recorded on the ticket as events; the bytes are written first, so no
attachment ever points at a missing file. Only images, video, audio, PDF
and plain text are shown inline, everything with nosniff and a sandbox CSP.
The web shows thumbnails, uploads by drag and drop or by pasting a
screenshot, and attaches files to new comments.

Also adds `nx run api:contracts`, which writes schema.gql and
openapi.json without starting the API or any database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/presenters/src/lib/graphql/issue.resolver.ts

@@ -183,6 +183,18 @@ export class IssueResolver {
     );
   }
 
+  @Mutation(() => CommandResultGql, {
+    description:
+      'Remove a file from a ticket (whoever uploaded it, or an owner/admin). Upload with the REST API.',
+  })
+  removeAttachment(
+    @CurrentUser() me: User,
+    @Args('issueId', { type: () => ID }) issueId: string,
+    @Args('attachmentId', { type: () => ID }) attachmentId: string,
+  ) {
+    return this.issuesService.detach(me.id, issueId, attachmentId);
+  }
+
   @Mutation(() => CommandResultGql, {
     description: 'Assign (or unassign with null) a project member',
   })

libs/api/tracker/presenters/src/lib/graphql/types.ts

@@ -91,6 +91,24 @@ export class IssueLinkGql {
   @Field() issueKey!: string;
 }
 
+@ObjectType('Attachment', {
+  description:
+    'A file on a ticket. Download it from the REST API: GET /api/issues/{issueId}/attachments/{id}',
+})
+export class AttachmentGql {
+  @Field(() => ID) id!: string;
+  @Field() fileName!: string;
+  @Field() mimeType!: string;
+  @Field(() => Int, { description: 'Bytes' }) size!: number;
+  @Field(() => UserRefGql) uploadedBy!: UserRefGql;
+  @Field() uploadedAt!: string;
+  @Field(() => ID, {
+    nullable: true,
+    description: 'The comment it was attached to, if any',
+  })
+  commentId!: string | null;
+}
+
 @ObjectType('ReleaseRef')
 export class ReleaseRefGql {
   @Field(() => ID) id!: string;
@@ -123,6 +141,7 @@ export class IssueGql {
   @Field(() => Int, { nullable: true }) storyPoints!: number | null;
   @Field(() => String, { nullable: true }) dueDate!: string | null;
   @Field(() => [IssueLinkGql]) links!: IssueLinkGql[];
+  @Field(() => [AttachmentGql]) attachments!: AttachmentGql[];
   @Field(() => Int) commentCount!: number;
   @Field() createdAt!: string;
   @Field() updatedAt!: string;