fix(api): typed OpenAPI query params and not-found messages that hide private projects

- Query DTO properties with a default value (limit, offset, days, perColumn,
  assignedToMe, search, archived, requiresReason, force) were documented as
  `object` in openapi.json, which broke generated clients. They now declare
  their type explicitly.
- Reading a private project, ticket, release or its comments without access
  answered "Project <internal id> not found", confirming the project exists.
  ReadAccess now reports what the caller asked for (e2e covered).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/application/src/lib/queries/get-issue.query-handler.ts

@@ -18,7 +18,10 @@ export class GetIssueQueryHandler
       ? await this.findIssues.findById(query.idOrKey)
       : await this.findIssues.findByKey(query.idOrKey.toUpperCase());
     const found = this.access.assertFound(issue, 'Issue', query.idOrKey);
-    await this.access.assertCanView(found.projectId, query.viewerId);
+    await this.access.assertCanView(found.projectId, query.viewerId, {
+      entity: 'Issue',
+      ref: query.idOrKey,
+    });
     return found;
   }
 }