feat(api): REST API with OpenAPI for other apps, behind Pireon OAuth

A REST adapter next to GraphQL (presenters/http) that calls the same
application services, so validation, permissions and domain errors are the
same: projects (members, board, stats, activity), issues (search, workflow,
assignee, release, links, comments, history), comments, releases and users.
Projects and issues can be addressed by id or key (WEB, WEB-12).

- Swagger UI at /api/docs, document at /api/docs-json and apps/api/openapi.json
  (rewritten by `nx serve api`, like schema.gql) for client generation.
- Every route but health/auth/webhook needs a Pireon token: the document
  declares Pireon OAuth2 (authorization code + PKCE, password) through the
  /api/auth/token proxy, and a bearer scheme for apps with their own client.
- configureApp() shares main.ts setup with the e2e, which now also covers REST.
- SWAGGER_ENABLED / OPENAPI_FILE config; docs 03/05 and library READMEs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/presenters/src/lib/graphql/issue.resolver.ts

@@ -15,7 +15,6 @@ import {
   IssuesService,
 } from '@task-stream/api/tracker/application';
 import {
-  IssueDetails,
   IssueReadModel,
   IssueStatus,
   IssueWorkflow,
@@ -27,6 +26,7 @@ import {
   LinkIssuesInput,
   UpdateIssueInput,
 } from './inputs';
+import { withoutNulls } from '../common/issue-input';
 import {
   ActivityGql,
   CommandResultGql,
@@ -35,15 +35,6 @@ import {
   IssuePageGql,
 } from './types';
 
-/** GraphQL sends explicit nulls; the domain only accepts them on nullable fields. */
-function withoutNulls<T extends Partial<IssueDetails>>(input: T): T {
-  const details = { ...input };
-  for (const field of ['title', 'type', 'priority', 'labels'] as const) {
-    if (details[field] === null) delete details[field];
-  }
-  return details;
-}
-
 @Resolver(() => IssueGql)
 export class IssueResolver {
   constructor(