feat: public projects, project deletion and sagas

Public projects:
- Project.isPublic (create/update, owners and admins). Anyone can read a
  public project without a token: project, board, tickets, comments,
  history, releases, activity, tracking and statistics, over GraphQL and
  REST. Writes stay for members (401 anonymous, 403 outsiders).
- @OptionalAuth() / @ApiOptionalPireonAuth(): anonymous callers allowed,
  invalid tokens still rejected. ReadAccess lets anonymous viewers read
  public projects only; linked tickets are filtered by visibility.
- publicProjects (GraphQL) and GET /api/explore/projects (REST).
- Web: «Explorar» page, project pages open without a session (read-only
  notice, sign-in hints), public badge, visibility switch in settings,
  no realtime subscriptions without a session.

Project deletion:
- Owner only, confirming the key (deleteProject / DELETE
  /api/projects/{project}?confirm=KEY). The key is freed; the read model
  drops the project and members are notified (web goes home).

Sagas (run by the EventsBridge after projections, durable and ordered):
- ProjectDeletionSaga: project deleted → delete its tickets and releases;
  ticket deleted → purge its comments and drop links from other tickets.
- ReleaseArchivedSaga: unfinished tickets leave an archived release.
- UserDeactivatedSaga: the Pireon webhook records UserDeactivatedEvent in
  the event store (EventRecorder); the tracker unassigns that user's open
  tickets as the system actor.
- Internal idempotent commands; domain refusals are logged and skipped,
  concurrency conflicts retried. Affected streams come from the event store
  (TrackerStreamsRepository).

Tests: domain lifecycle specs, saga specs run like the bridge, facade
tests, e2e for public access, cascade deletion, archived releases and
deactivation webhook. Docs, READMEs, schema.gql/openapi.json and Word/PDF
updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/application/src/lib/projects.service.ts

@@ -12,6 +12,7 @@ import { AddProjectMemberCommand } from './commands/add-project-member.command';
 import { ChangeProjectMemberRoleCommand } from './commands/change-project-member-role.command';
 import { CommandResult } from './commands/command-result';
 import { CreateProjectCommand } from './commands/create-project.command';
+import { DeleteProjectCommand } from './commands/delete-project.command';
 import { RemoveProjectMemberCommand } from './commands/remove-project-member.command';
 import { UpdateProjectCommand } from './commands/update-project.command';
 import { UpdateProjectSettingsCommand } from './commands/update-project-settings.command';
@@ -20,6 +21,7 @@ import { BoardColumn, GetBoardQuery } from './queries/get-board.query';
 import { GetMyProjectsQuery } from './queries/get-my-projects.query';
 import { GetProjectAnalyticsQuery } from './queries/get-project-analytics.query';
 import { GetProjectStatsQuery } from './queries/get-project-stats.query';
+import { GetPublicProjectsQuery } from './queries/get-public-projects.query';
 import { GetProjectQuery } from './queries/get-project.query';
 import { GetReleasesQuery } from './queries/get-releases.query';
 
@@ -32,7 +34,12 @@ export class ProjectsService {
 
   create(
     actorId: string,
-    input: { key: string; name: string; description?: string | null },
+    input: {
+      key: string;
+      name: string;
+      description?: string | null;
+      isPublic?: boolean;
+    },
   ): Promise<CommandResult> {
     return this.commandBus.execute(
       new CreateProjectCommand(
@@ -40,6 +47,7 @@ export class ProjectsService {
         input.key,
         input.name,
         input.description,
+        input.isPublic ?? false,
       ),
     );
   }
@@ -47,13 +55,32 @@ export class ProjectsService {
   update(
     actorId: string,
     projectId: string,
-    changes: { name?: string; description?: string | null },
+    changes: { name?: string; description?: string | null; isPublic?: boolean },
   ): Promise<CommandResult> {
     return this.commandBus.execute(
       new UpdateProjectCommand(actorId, projectId, changes),
     );
   }
 
+  /**
+   * Owner only, typing the key to confirm. Tickets, comments and releases
+   * are deleted right after by ProjectDeletionSaga; the key is freed.
+   */
+  delete(
+    actorId: string,
+    projectId: string,
+    confirmKey: string,
+  ): Promise<CommandResult> {
+    return this.commandBus.execute(
+      new DeleteProjectCommand(actorId, projectId, confirmKey),
+    );
+  }
+
+  /** Projects anyone can read, also without signing in. */
+  findPublic(): Promise<ProjectReadModel[]> {
+    return this.queryBus.execute(new GetPublicProjectsQuery());
+  }
+
   /** Statuses, transitions, ticket types and areas (owners and admins). */
   updateSettings(
     actorId: string,
@@ -109,16 +136,19 @@ export class ProjectsService {
     return this.queryBus.execute(new GetMyProjectsQuery(viewerId));
   }
 
-  findOne(viewerId: string, idOrKey: string): Promise<ProjectReadModel> {
+  findOne(viewerId: string | null, idOrKey: string): Promise<ProjectReadModel> {
     return this.queryBus.execute(new GetProjectQuery(viewerId, idOrKey));
   }
 
-  stats(viewerId: string, projectId: string): Promise<ProjectStatsReadModel> {
+  stats(
+    viewerId: string | null,
+    projectId: string,
+  ): Promise<ProjectStatsReadModel> {
     return this.queryBus.execute(new GetProjectStatsQuery(viewerId, projectId));
   }
 
   board(
-    viewerId: string,
+    viewerId: string | null,
     filter: Omit<IssueFilter, 'statuses' | 'limit' | 'offset'>,
     perColumn?: number,
   ): Promise<BoardColumn[]> {
@@ -127,13 +157,16 @@ export class ProjectsService {
     );
   }
 
-  releases(viewerId: string, projectId: string): Promise<ReleaseReadModel[]> {
+  releases(
+    viewerId: string | null,
+    projectId: string,
+  ): Promise<ReleaseReadModel[]> {
     return this.queryBus.execute(new GetReleasesQuery(viewerId, projectId));
   }
 
   /** Statistics over the last `days` days (created vs resolved, flow, times, QA). */
   analytics(
-    viewerId: string,
+    viewerId: string | null,
     projectId: string,
     days: number,
   ): Promise<ProjectAnalyticsReadModel> {