feat: guest role for clients and outsiders

A project member can be a GUEST. In a private project a guest only sees
the tickets they take part in (opened, assigned or followed): every other
ticket answers 404, also in my work, realtime changes, blockers and
linked tickets, and project-wide views (activity, statistics, dashboard,
releases, sprints, epics, trash) answer 403. Guests open tickets without
assigning or planning them, and comment, attach, follow and vote on their
own; they change nothing else. In a public project they see what anyone
does. The web gives them only Tablero, Lista and Miembros and loads none
of the project-wide data.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/application/src/lib/queries/get-release-progress.query-handler.ts

@@ -23,10 +23,14 @@ export class GetReleaseProgressQueryHandler
       'Release',
       query.releaseId,
     );
-    await this.access.assertCanView(release.projectId, query.viewerId, {
-      entity: 'Release',
-      ref: query.releaseId,
-    });
+    await this.access.assertSeesWholeProject(
+      release.projectId,
+      query.viewerId,
+      {
+        entity: 'Release',
+        ref: query.releaseId,
+      },
+    );
     return this.findIssues.releaseProgress(release.id);
   }
 }