feat(api): REST API with OpenAPI for other apps, behind Pireon OAuth

A REST adapter next to GraphQL (presenters/http) that calls the same
application services, so validation, permissions and domain errors are the
same: projects (members, board, stats, activity), issues (search, workflow,
assignee, release, links, comments, history), comments, releases and users.
Projects and issues can be addressed by id or key (WEB, WEB-12).

- Swagger UI at /api/docs, document at /api/docs-json and apps/api/openapi.json
  (rewritten by `nx serve api`, like schema.gql) for client generation.
- Every route but health/auth/webhook needs a Pireon token: the document
  declares Pireon OAuth2 (authorization code + PKCE, password) through the
  /api/auth/token proxy, and a bearer scheme for apps with their own client.
- configureApp() shares main.ts setup with the e2e, which now also covers REST.
- SWAGGER_ENABLED / OPENAPI_FILE config; docs 03/05 and library READMEs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/presenters/src/lib/http/comments.controller.ts

@@ -0,0 +1,39 @@
+import { Body, Controller, Delete, Param, Patch } from '@nestjs/common';
+import { ApiOkResponse, ApiOperation, ApiTags } from '@nestjs/swagger';
+import { User } from '@task-stream/api/identity/domain';
+import {
+  ApiPireonAuth,
+  CurrentUser,
+} from '@task-stream/api/identity/presenters';
+import { ApiCommandErrors } from '@task-stream/api/shared/presenters';
+import { CommentsService } from '@task-stream/api/tracker/application';
+import { CommentBodyDto } from './dto/requests.dto';
+import { CommandResultDto } from './dto/responses.dto';
+
+/** REST adapter of the comment use cases (listing and adding live under /issues). */
+@ApiTags('Comments')
+@ApiPireonAuth()
+@Controller('comments')
+export class CommentsController {
+  constructor(private readonly comments: CommentsService) {}
+
+  @Patch(':commentId')
+  @ApiOperation({ summary: 'Edit a comment (author only)' })
+  @ApiOkResponse({ type: CommandResultDto })
+  @ApiCommandErrors()
+  edit(
+    @CurrentUser() me: User,
+    @Param('commentId') commentId: string,
+    @Body() body: CommentBodyDto,
+  ) {
+    return this.comments.edit(me.id, commentId, body.body);
+  }
+
+  @Delete(':commentId')
+  @ApiOperation({ summary: 'Delete a comment (author or project admin)' })
+  @ApiOkResponse({ type: CommandResultDto })
+  @ApiCommandErrors()
+  delete(@CurrentUser() me: User, @Param('commentId') commentId: string) {
+    return this.comments.delete(me.id, commentId);
+  }
+}