refactor(api): buses only in services, atomic commands, @Prop schemas

- Mongo read models are @Schema/@Prop classes (SchemaFactory), still
  loose: the props declared are the indexed or shaped ones.
- CommandBus and QueryBus are used by the application services alone.
  Duplicating a ticket, bulk updates, CSV imports, proposals and
  emptying the trash chain several commands, so they are service
  methods now and their composite commands are gone; every command
  handler is atomic. No forwardRef is needed.
- The due-date and trash timers are entry points: they live in the
  presenters and call the services. The automations event handler has
  its own file and calls AutomationsService.
- The tracker's user directory asks IdentityService; the composition
  root hands the identity application module to the tracker
  infrastructure (withIdentity), with no global module.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/api/src/app/app.module.ts

@@ -24,11 +24,16 @@ import { HealthController } from './health.controller';
  * Composition root. Each bounded context is assembled outside-in:
  *   presenters (GraphQL/HTTP) → application (services, CQRS handlers) → infrastructure (adapters)
  */
-const identity = IdentityPresentersModule.withApplication(
-  IdentityApplicationModule.withInfrastructure(IdentityInfrastructureModule),
+const identityApplication = IdentityApplicationModule.withInfrastructure(
+  IdentityInfrastructureModule,
 );
+const identity = IdentityPresentersModule.withApplication(identityApplication);
+// The tracker's user directory asks the identity context (IdentityService):
+// the same module, so one identity context serves both.
 const tracker = TrackerPresentersModule.withApplication(
-  TrackerApplicationModule.withInfrastructure(TrackerInfrastructureModule),
+  TrackerApplicationModule.withInfrastructure(
+    TrackerInfrastructureModule.withIdentity(identityApplication),
+  ),
 );
 
 @Module({