feat: guest role for clients and outsiders

A project member can be a GUEST. In a private project a guest only sees
the tickets they take part in (opened, assigned or followed): every other
ticket answers 404, also in my work, realtime changes, blockers and
linked tickets, and project-wide views (activity, statistics, dashboard,
releases, sprints, epics, trash) answer 403. Guests open tickets without
assigning or planning them, and comment, attach, follow and vote on their
own; they change nothing else. In a public project they see what anyone
does. The web gives them only Tablero, Lista and Miembros and loads none
of the project-wide data.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/presenters/src/lib/graphql/issue.resolver.ts

@@ -223,8 +223,11 @@ export class IssueResolver {
     description:
       'Open tickets it waits for: the ones that block it and the ones it depends on',
   })
-  blockedBy(@Parent() issue: IssueReadModel) {
-    return this.blockers.blockedBy(issue);
+  blockedBy(
+    @CurrentUser() me: User | undefined,
+    @Parent() issue: IssueReadModel,
+  ) {
+    return this.blockers.blockedBy(issue, viewerOf(me));
   }
 
   @ResolveField(() => Boolean, { description: 'Whether I voted for it' })

libs/api/tracker/presenters/src/lib/http/refs.ts

@@ -44,7 +44,7 @@ export class Refs {
   async issueDto(issue: IssueReadModel, viewerId: string | null) {
     const [allowedTransitions, blockedBy] = await Promise.all([
       this.workflows.allowedTransitions(issue),
-      this.blockers.blockedBy(issue),
+      this.blockers.blockedBy(issue, viewerId),
     ]);
     // Who voted is only for telling someone whether they did.
     const { voterIds, ...shown } = issue;