feat: guest role for clients and outsiders

A project member can be a GUEST. In a private project a guest only sees
the tickets they take part in (opened, assigned or followed): every other
ticket answers 404, also in my work, realtime changes, blockers and
linked tickets, and project-wide views (activity, statistics, dashboard,
releases, sprints, epics, trash) answer 403. Guests open tickets without
assigning or planning them, and comment, attach, follow and vote on their
own; they change nothing else. In a public project they see what anyone
does. The web gives them only Tablero, Lista and Miembros and loads none
of the project-wide data.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/application/src/lib/queries/get-board.query-handler.ts

@@ -27,6 +27,11 @@ export class GetBoardQueryHandler
    */
   async execute(query: GetBoardQuery): Promise<BoardColumn[]> {
     await this.access.assertCanView(query.filter.projectId, query.viewerId);
+    const participantId =
+      (await this.access.participantScope(
+        query.filter.projectId,
+        query.viewerId,
+      )) ?? undefined;
     const project = await this.findProjects.findById(query.filter.projectId);
     const statuses = (
       project?.settings ?? DEFAULT_PROJECT_SETTINGS
@@ -35,6 +40,7 @@ export class GetBoardQueryHandler
       statuses.map(async (status) => {
         const page = await this.findIssues.search({
           ...query.filter,
+          participantId,
           statuses: [status.id],
           // Each column follows the backlog order.
           sort: IssueSort.RANK,