feat: public projects, project deletion and sagas

Public projects:
- Project.isPublic (create/update, owners and admins). Anyone can read a
  public project without a token: project, board, tickets, comments,
  history, releases, activity, tracking and statistics, over GraphQL and
  REST. Writes stay for members (401 anonymous, 403 outsiders).
- @OptionalAuth() / @ApiOptionalPireonAuth(): anonymous callers allowed,
  invalid tokens still rejected. ReadAccess lets anonymous viewers read
  public projects only; linked tickets are filtered by visibility.
- publicProjects (GraphQL) and GET /api/explore/projects (REST).
- Web: «Explorar» page, project pages open without a session (read-only
  notice, sign-in hints), public badge, visibility switch in settings,
  no realtime subscriptions without a session.

Project deletion:
- Owner only, confirming the key (deleteProject / DELETE
  /api/projects/{project}?confirm=KEY). The key is freed; the read model
  drops the project and members are notified (web goes home).

Sagas (run by the EventsBridge after projections, durable and ordered):
- ProjectDeletionSaga: project deleted → delete its tickets and releases;
  ticket deleted → purge its comments and drop links from other tickets.
- ReleaseArchivedSaga: unfinished tickets leave an archived release.
- UserDeactivatedSaga: the Pireon webhook records UserDeactivatedEvent in
  the event store (EventRecorder); the tracker unassigns that user's open
  tickets as the system actor.
- Internal idempotent commands; domain refusals are logged and skipped,
  concurrency conflicts retried. Affected streams come from the event store
  (TrackerStreamsRepository).

Tests: domain lifecycle specs, saga specs run like the bridge, facade
tests, e2e for public access, cascade deletion, archived releases and
deactivation webhook. Docs, READMEs, schema.gql/openapi.json and Word/PDF
updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/web/src/app/app.routes.spec.ts

@@ -2,17 +2,28 @@ import { authGuard } from '@task-stream/web/identity/presenters';
 import { appRoutes } from './app.routes';
 
 describe('appRoutes', () => {
-  it('keeps sign-in public and everything else behind the auth guard', () => {
+  it('keeps home behind the auth guard, and public projects and «Explorar» open', () => {
     const paths = appRoutes.map((route) => route.path);
-    expect(paths).toEqual(expect.arrayContaining(['login', 'auth/callback', '', '**']));
+    expect(paths).toEqual(
+      expect.arrayContaining(['login', 'auth/callback', '', '**']),
+    );
 
     const app = appRoutes.find((route) => route.path === '' && route.children);
-    expect(app?.canActivate).toContain(authGuard);
-    expect(app?.children?.map((route) => route.path)).toEqual(['', 'p/:key']);
+    const children = app?.children ?? [];
+    expect(children.map((route) => route.path)).toEqual([
+      '',
+      'explorar',
+      'p/:key',
+    ]);
+    expect(children[0].canActivate).toContain(authGuard);
+    expect(children[1].canActivate).toBeUndefined();
+    expect(children[2].canActivate).toBeUndefined();
   });
 
   it('exposes every project section', () => {
-    const project = appRoutes.find((route) => route.path === '')?.children?.find((route) => route.path === 'p/:key');
+    const project = appRoutes
+      .find((route) => route.path === '')
+      ?.children?.find((route) => route.path === 'p/:key');
     expect(project?.children?.map((route) => route.path)).toEqual([
       '',
       'board',

apps/web/src/app/app.routes.ts

@@ -1,12 +1,10 @@
 import { Route } from '@angular/router';
-import {
-  authGuard,
-  identityRoutes,
-} from '@task-stream/web/identity/presenters';
+import { identityRoutes } from '@task-stream/web/identity/presenters';
 import { trackerRoutes } from '@task-stream/web/tracker/presenters';
 
 export const appRoutes: Route[] = [
   ...identityRoutes,
-  { path: '', canActivate: [authGuard], children: trackerRoutes },
+  // Not all behind the guard: public projects are readable without a session.
+  { path: '', children: trackerRoutes },
   { path: '**', redirectTo: '' },
 ];

apps/web/src/app/app.ts

@@ -1,5 +1,13 @@
 import { ChangeDetectionStrategy, Component, inject } from '@angular/core';
-import { RouterLink, RouterLinkActive, RouterOutlet } from '@angular/router';
+import { toSignal } from '@angular/core/rxjs-interop';
+import {
+  NavigationEnd,
+  Router,
+  RouterLink,
+  RouterLinkActive,
+  RouterOutlet,
+} from '@angular/router';
+import { filter, map } from 'rxjs';
 import { AuthFacade } from '@task-stream/web/identity/application';
 import { UserMenuComponent } from '@task-stream/web/identity/presenters';
 import { AppShellComponent } from '@task-stream/web/shared/ui';
@@ -27,8 +35,20 @@ import { AppShellComponent } from '@task-stream/web/shared/ui';
           Proyectos
         </a>
       }
+      <a
+        shellNav
+        class="ts-nav-link"
+        routerLink="/explorar"
+        routerLinkActive="is-active"
+      >
+        Explorar
+      </a>
       @if (auth.isAuthenticated()) {
         <ts-user-menu shellUser />
+      } @else if (auth.settled() && !onLogin()) {
+        <a shellUser class="ts-nav-link ts-nav-link--cta" routerLink="/login"
+          >Iniciar sesión</a
+        >
       }
       <router-outlet />
     </ts-app-shell>
@@ -36,4 +56,13 @@ import { AppShellComponent } from '@task-stream/web/shared/ui';
 })
 export class App {
   protected readonly auth = inject(AuthFacade);
+  private readonly router = inject(Router);
+  /** The login page has its own form: no "Iniciar sesión" button there. */
+  protected readonly onLogin = toSignal(
+    this.router.events.pipe(
+      filter((event) => event instanceof NavigationEnd),
+      map(() => this.router.url.startsWith('/login')),
+    ),
+    { initialValue: false },
+  );
 }