feat: attachments on tickets and comments

Files are uploaded over REST, stored on disk (a volume in Docker) and
recorded on the ticket as events; the bytes are written first, so no
attachment ever points at a missing file. Only images, video, audio, PDF
and plain text are shown inline, everything with nosniff and a sandbox CSP.
The web shows thumbnails, uploads by drag and drop or by pasting a
screenshot, and attaches files to new comments.

Also adds `nx run api:contracts`, which writes schema.gql and
openapi.json without starting the API or any database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/presenters/src/lib/http/dto/requests.dto.ts

@@ -22,6 +22,7 @@ import {
   IsInt,
   IsISO8601,
   IsOptional,
+  IsUUID,
   IsString,
   IsUrl,
   Matches,
@@ -576,6 +577,20 @@ export class LinkTypeParamDto {
   type!: IssueLinkType;
 }
 
+/** Multipart body of an upload; the file itself travels as `file`. */
+export class AttachFileDto {
+  @ApiProperty({ type: 'string', format: 'binary', description: 'The file' })
+  file?: unknown;
+
+  @ApiPropertyOptional({
+    format: 'uuid',
+    description: "One of the ticket's comments, to show the file under it",
+  })
+  @IsOptional()
+  @IsUUID()
+  commentId?: string;
+}
+
 export class CommentBodyDto {
   @ApiProperty({ example: 'Reproducido en Safari 17.', maxLength: 20000 })
   @IsString()