feat: public projects, project deletion and sagas

Public projects:
- Project.isPublic (create/update, owners and admins). Anyone can read a
  public project without a token: project, board, tickets, comments,
  history, releases, activity, tracking and statistics, over GraphQL and
  REST. Writes stay for members (401 anonymous, 403 outsiders).
- @OptionalAuth() / @ApiOptionalPireonAuth(): anonymous callers allowed,
  invalid tokens still rejected. ReadAccess lets anonymous viewers read
  public projects only; linked tickets are filtered by visibility.
- publicProjects (GraphQL) and GET /api/explore/projects (REST).
- Web: «Explorar» page, project pages open without a session (read-only
  notice, sign-in hints), public badge, visibility switch in settings,
  no realtime subscriptions without a session.

Project deletion:
- Owner only, confirming the key (deleteProject / DELETE
  /api/projects/{project}?confirm=KEY). The key is freed; the read model
  drops the project and members are notified (web goes home).

Sagas (run by the EventsBridge after projections, durable and ordered):
- ProjectDeletionSaga: project deleted → delete its tickets and releases;
  ticket deleted → purge its comments and drop links from other tickets.
- ReleaseArchivedSaga: unfinished tickets leave an archived release.
- UserDeactivatedSaga: the Pireon webhook records UserDeactivatedEvent in
  the event store (EventRecorder); the tracker unassigns that user's open
  tickets as the system actor.
- Internal idempotent commands; domain refusals are logged and skipped,
  concurrency conflicts retried. Affected streams come from the event store
  (TrackerStreamsRepository).

Tests: domain lifecycle specs, saga specs run like the bridge, facade
tests, e2e for public access, cascade deletion, archived releases and
deactivation webhook. Docs, READMEs, schema.gql/openapi.json and Word/PDF
updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/application/src/lib/queries/read-access.ts

@@ -3,23 +3,38 @@ import { NotFoundError } from '@task-stream/api/shared/domain';
 import { ProjectRole } from '@task-stream/api/tracker/domain';
 import { FindProjectsRepository } from '../ports/find-projects.repository';
 
-/** Authorisation for the read side, based on the projected memberships. */
+/**
+ * Authorisation for the read side, based on the projected memberships:
+ * members read their projects; anyone (also anonymous, `viewerId` null)
+ * reads public ones.
+ */
 @Injectable()
 export class ReadAccess {
   constructor(private readonly findProjects: FindProjectsRepository) {}
 
+  /** The viewer's role, or null when they read a public project as an outsider. */
   async assertCanView(
     projectId: string,
-    viewerId: string,
-  ): Promise<ProjectRole> {
-    const role = await this.findProjects.findRole(projectId, viewerId);
+    viewerId: string | null,
+  ): Promise<ProjectRole | null> {
+    const role = viewerId
+      ? await this.findProjects.findRole(projectId, viewerId)
+      : null;
+    if (role) return role;
+    const project = await this.findProjects.findById(projectId);
     // Same answer for "doesn't exist" and "not yours": don't leak projects.
-    if (!role) throw new NotFoundError('Project', projectId);
-    return role;
+    if (!project?.isPublic) throw new NotFoundError('Project', projectId);
+    return null;
   }
 
-  async canView(projectId: string, viewerId: string): Promise<boolean> {
-    return (await this.findProjects.findRole(projectId, viewerId)) !== null;
+  async canView(projectId: string, viewerId: string | null): Promise<boolean> {
+    try {
+      await this.assertCanView(projectId, viewerId);
+      return true;
+    } catch (error) {
+      if (error instanceof NotFoundError) return false;
+      throw error;
+    }
   }
 
   assertFound<T>(value: T | null, entity: string, id: string): T {