feat(api): REST API with OpenAPI for other apps, behind Pireon OAuth

A REST adapter next to GraphQL (presenters/http) that calls the same
application services, so validation, permissions and domain errors are the
same: projects (members, board, stats, activity), issues (search, workflow,
assignee, release, links, comments, history), comments, releases and users.
Projects and issues can be addressed by id or key (WEB, WEB-12).

- Swagger UI at /api/docs, document at /api/docs-json and apps/api/openapi.json
  (rewritten by `nx serve api`, like schema.gql) for client generation.
- Every route but health/auth/webhook needs a Pireon token: the document
  declares Pireon OAuth2 (authorization code + PKCE, password) through the
  /api/auth/token proxy, and a bearer scheme for apps with their own client.
- configureApp() shares main.ts setup with the e2e, which now also covers REST.
- SWAGGER_ENABLED / OPENAPI_FILE config; docs 03/05 and library READMEs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/presenters/README.md

@@ -1,6 +1,6 @@
 # api-tracker-presenters
 
-API GraphQL del tracker.
+API GraphQL y REST (OpenAPI) del tracker.
 
 - **Import**: `@task-stream/api/tracker/presenters`
 - **Capa**: `presenters` · **Tags**: `scope:api-tracker`, `type:presenters`
@@ -9,8 +9,11 @@ API GraphQL del tracker.
 
 - Resolvers `ProjectResolver`, `IssueResolver`, `CommentResolver`, `ReleaseResolver` y `SubscriptionResolver`; solo llaman a services.
 - Tipos, inputs (con `class-validator`) y enums de GraphQL (code-first).
+- `http/`: controladores REST `ProjectsController`, `IssuesController`, `CommentsController`, `ReleasesController`
+  (mismos services), DTOs con `@nestjs/swagger` y `Refs` (proyectos y tickets por id o clave).
 
-Operaciones disponibles: [API](../../../../docs/03-api.md#32-graphql).
+Operaciones disponibles: [GraphQL](../../../../docs/03-api.md#32-graphql) y
+[REST](../../../../docs/03-api.md#33-rest-con-openapi-para-otras-apps).
 
 ## Comandos