feat: guest role for clients and outsiders

A project member can be a GUEST. In a private project a guest only sees
the tickets they take part in (opened, assigned or followed): every other
ticket answers 404, also in my work, realtime changes, blockers and
linked tickets, and project-wide views (activity, statistics, dashboard,
releases, sprints, epics, trash) answer 403. Guests open tickets without
assigning or planning them, and comment, attach, follow and vote on their
own; they change nothing else. In a public project they see what anyone
does. The web gives them only Tablero, Lista and Miembros and loads none
of the project-wide data.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/application/src/lib/queries/search-my-issues.query-handler.ts

@@ -7,6 +7,7 @@ import {
 import { FindIssuesRepository, Page } from '../ports/find-issues.repository';
 import { FindProjectsRepository } from '../ports/find-projects.repository';
 import { SearchMyIssuesQuery } from './search-my-issues.query';
+import { guestOnly } from './read-access';
 
 @QueryHandler(SearchMyIssuesQuery)
 export class SearchMyIssuesQueryHandler
@@ -41,8 +42,13 @@ export class SearchMyIssuesQueryHandler
       StatusCategory.IN_PROGRESS,
       StatusCategory.QA,
     ];
+    const guestProjectIds = projects
+      .filter((p) => guestOnly(p, query.viewerId))
+      .map((p) => p.id);
     return this.findIssues.searchAcross({
       projectIds: projects.map((project) => project.id),
+      guestProjectIds,
+      participantId: query.viewerId,
       priorities: filter.priorities?.length ? filter.priorities : undefined,
       typesByProject: bugTypes,
       dueBefore: filter.overdue