feat: attachments on tickets and comments

Files are uploaded over REST, stored on disk (a volume in Docker) and
recorded on the ticket as events; the bytes are written first, so no
attachment ever points at a missing file. Only images, video, audio, PDF
and plain text are shown inline, everything with nosniff and a sandbox CSP.
The web shows thumbnails, uploads by drag and drop or by pasting a
screenshot, and attaches files to new comments.

Also adds `nx run api:contracts`, which writes schema.gql and
openapi.json without starting the API or any database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/presenters/src/lib/http/dto/responses.dto.ts

@@ -106,6 +106,22 @@ export class ReleaseRefDto {
   @ApiProperty({ example: 'v1.4.0' }) name!: string;
 }
 
+export class AttachmentDto {
+  @ApiProperty({ format: 'uuid' }) id!: string;
+  @ApiProperty({ example: 'captura-login.png' }) fileName!: string;
+  @ApiProperty({ example: 'image/png' }) mimeType!: string;
+  @ApiProperty({ description: 'Bytes', example: 48213 }) size!: number;
+  @ApiProperty({ type: UserRefDto }) uploadedBy!: UserRefDto;
+  @ApiProperty({ format: 'date-time' }) uploadedAt!: string;
+  @ApiProperty({
+    type: String,
+    nullable: true,
+    format: 'uuid',
+    description: 'The comment it was attached to, if any',
+  })
+  commentId!: string | null;
+}
+
 export class IssueDto {
   @ApiProperty({ format: 'uuid' }) id!: string;
   @ApiProperty({ format: 'uuid' }) projectId!: string;
@@ -141,6 +157,7 @@ export class IssueDto {
   @ApiProperty({ type: String, nullable: true, format: 'date' })
   dueDate!: string | null;
   @ApiProperty({ type: [IssueLinkDto] }) links!: IssueLinkDto[];
+  @ApiProperty({ type: [AttachmentDto] }) attachments!: AttachmentDto[];
   @ApiProperty() commentCount!: number;
   @ApiProperty({ format: 'date-time' }) createdAt!: string;
   @ApiProperty({ format: 'date-time' }) updatedAt!: string;