feat(api): REST API with OpenAPI for other apps, behind Pireon OAuth

A REST adapter next to GraphQL (presenters/http) that calls the same
application services, so validation, permissions and domain errors are the
same: projects (members, board, stats, activity), issues (search, workflow,
assignee, release, links, comments, history), comments, releases and users.
Projects and issues can be addressed by id or key (WEB, WEB-12).

- Swagger UI at /api/docs, document at /api/docs-json and apps/api/openapi.json
  (rewritten by `nx serve api`, like schema.gql) for client generation.
- Every route but health/auth/webhook needs a Pireon token: the document
  declares Pireon OAuth2 (authorization code + PKCE, password) through the
  /api/auth/token proxy, and a bearer scheme for apps with their own client.
- configureApp() shares main.ts setup with the e2e, which now also covers REST.
- SWAGGER_ENABLED / OPENAPI_FILE config; docs 03/05 and library READMEs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/presenters/src/lib/http/releases.controller.ts

@@ -0,0 +1,164 @@
+import {
+  Body,
+  Controller,
+  Get,
+  HttpCode,
+  Param,
+  Patch,
+  Post,
+  Query,
+} from '@nestjs/common';
+import {
+  ApiCreatedResponse,
+  ApiOkResponse,
+  ApiOperation,
+  ApiParam,
+  ApiTags,
+} from '@nestjs/swagger';
+import { User } from '@task-stream/api/identity/domain';
+import {
+  ApiPireonAuth,
+  CurrentUser,
+} from '@task-stream/api/identity/presenters';
+import {
+  ApiCommandErrors,
+  ApiReadErrors,
+} from '@task-stream/api/shared/presenters';
+import {
+  IssuesService,
+  ProjectsService,
+  ReleasesService,
+} from '@task-stream/api/tracker/application';
+import {
+  CreateReleaseDto,
+  PageQueryDto,
+  PublishReleaseDto,
+  UpdateReleaseDto,
+} from './dto/requests.dto';
+import {
+  CommandResultDto,
+  IssuePageDto,
+  ReleaseDto,
+  ReleaseProgressDto,
+} from './dto/responses.dto';
+import { Refs, toIssueDto } from './refs';
+
+const PROJECT = ApiParam({
+  name: 'project',
+  description: 'Project id or key',
+  example: 'WEB',
+});
+
+/** REST adapter of the release use cases: versions that group tickets. */
+@ApiTags('Releases')
+@ApiPireonAuth()
+@Controller()
+export class ReleasesController {
+  constructor(
+    private readonly releases: ReleasesService,
+    private readonly projects: ProjectsService,
+    private readonly issues: IssuesService,
+    private readonly refs: Refs,
+  ) {}
+
+  @Get('projects/:project/releases')
+  @PROJECT
+  @ApiOperation({ summary: 'Releases of a project' })
+  @ApiOkResponse({ type: [ReleaseDto] })
+  @ApiReadErrors()
+  async list(@CurrentUser() me: User, @Param('project') project: string) {
+    return this.projects.releases(
+      me.id,
+      await this.refs.projectId(me.id, project),
+    );
+  }
+
+  @Post('projects/:project/releases')
+  @PROJECT
+  @ApiOperation({ summary: 'Plan a release (owner/admin)' })
+  @ApiCreatedResponse({ type: CommandResultDto })
+  @ApiCommandErrors()
+  async create(
+    @CurrentUser() me: User,
+    @Param('project') project: string,
+    @Body() body: CreateReleaseDto,
+  ) {
+    return this.releases.create(me.id, {
+      ...body,
+      projectId: await this.refs.projectId(me.id, project),
+    });
+  }
+
+  @Get('releases/:releaseId')
+  @ApiOperation({ summary: 'A release' })
+  @ApiOkResponse({ type: ReleaseDto })
+  @ApiReadErrors()
+  findOne(@CurrentUser() me: User, @Param('releaseId') releaseId: string) {
+    return this.releases.findOne(me.id, releaseId);
+  }
+
+  @Patch('releases/:releaseId')
+  @ApiOperation({ summary: 'Rename, describe or move the target date' })
+  @ApiOkResponse({ type: CommandResultDto })
+  @ApiCommandErrors()
+  update(
+    @CurrentUser() me: User,
+    @Param('releaseId') releaseId: string,
+    @Body() body: UpdateReleaseDto,
+  ) {
+    return this.releases.update(me.id, releaseId, body);
+  }
+
+  @Get('releases/:releaseId/progress')
+  @ApiOperation({ summary: 'Finished tickets out of the total' })
+  @ApiOkResponse({ type: ReleaseProgressDto })
+  @ApiReadErrors()
+  progress(@CurrentUser() me: User, @Param('releaseId') releaseId: string) {
+    return this.releases.progress(me.id, releaseId);
+  }
+
+  @Get('releases/:releaseId/issues')
+  @ApiOperation({ summary: 'Tickets included in the release' })
+  @ApiOkResponse({ type: IssuePageDto })
+  @ApiReadErrors()
+  async issuesOf(
+    @CurrentUser() me: User,
+    @Param('releaseId') releaseId: string,
+    @Query() page: PageQueryDto,
+  ) {
+    const release = await this.releases.findOne(me.id, releaseId);
+    const found = await this.issues.search(me.id, {
+      projectId: release.projectId,
+      releaseId: release.id,
+      limit: page.limit,
+      offset: page.offset,
+    });
+    return { ...found, items: found.items.map(toIssueDto) };
+  }
+
+  @Post('releases/:releaseId/publish')
+  @HttpCode(200)
+  @ApiOperation({
+    summary: 'Ship the release',
+    description:
+      'Fails (422) while it has unfinished tickets unless `force` is true.',
+  })
+  @ApiOkResponse({ type: CommandResultDto })
+  @ApiCommandErrors()
+  publish(
+    @CurrentUser() me: User,
+    @Param('releaseId') releaseId: string,
+    @Body() body: PublishReleaseDto,
+  ) {
+    return this.releases.publish(me.id, releaseId, body.force);
+  }
+
+  @Post('releases/:releaseId/archive')
+  @HttpCode(200)
+  @ApiOperation({ summary: 'Archive a planned release (its tickets leave it)' })
+  @ApiOkResponse({ type: CommandResultDto })
+  @ApiCommandErrors()
+  archive(@CurrentUser() me: User, @Param('releaseId') releaseId: string) {
+    return this.releases.archive(me.id, releaseId);
+  }
+}