feat: public projects, project deletion and sagas

Public projects:
- Project.isPublic (create/update, owners and admins). Anyone can read a
  public project without a token: project, board, tickets, comments,
  history, releases, activity, tracking and statistics, over GraphQL and
  REST. Writes stay for members (401 anonymous, 403 outsiders).
- @OptionalAuth() / @ApiOptionalPireonAuth(): anonymous callers allowed,
  invalid tokens still rejected. ReadAccess lets anonymous viewers read
  public projects only; linked tickets are filtered by visibility.
- publicProjects (GraphQL) and GET /api/explore/projects (REST).
- Web: «Explorar» page, project pages open without a session (read-only
  notice, sign-in hints), public badge, visibility switch in settings,
  no realtime subscriptions without a session.

Project deletion:
- Owner only, confirming the key (deleteProject / DELETE
  /api/projects/{project}?confirm=KEY). The key is freed; the read model
  drops the project and members are notified (web goes home).

Sagas (run by the EventsBridge after projections, durable and ordered):
- ProjectDeletionSaga: project deleted → delete its tickets and releases;
  ticket deleted → purge its comments and drop links from other tickets.
- ReleaseArchivedSaga: unfinished tickets leave an archived release.
- UserDeactivatedSaga: the Pireon webhook records UserDeactivatedEvent in
  the event store (EventRecorder); the tracker unassigns that user's open
  tickets as the system actor.
- Internal idempotent commands; domain refusals are logged and skipped,
  concurrency conflicts retried. Affected streams come from the event store
  (TrackerStreamsRepository).

Tests: domain lifecycle specs, saga specs run like the bridge, facade
tests, e2e for public access, cascade deletion, archived releases and
deactivation webhook. Docs, READMEs, schema.gql/openapi.json and Word/PDF
updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/application/src/testing/in-memory.ts

@@ -11,6 +11,7 @@ import { IssueNumbersRepository } from '../lib/ports/issue-numbers.repository';
 import { ProjectKeysRepository } from '../lib/ports/project-keys.repository';
 import { ReleaseIssuesRepository } from '../lib/ports/release-issues.repository';
 import { ReleaseNamesRepository } from '../lib/ports/release-names.repository';
+import { TrackerStreamsRepository } from '../lib/ports/tracker-streams.repository';
 import {
   DirectoryUser,
   UserDirectory,
@@ -128,6 +129,9 @@ export class InMemoryProjectKeys extends ProjectKeysRepository {
       throw new BusinessRuleError(`Project key ${key} is already taken`);
     this.keys.add(key);
   }
+  async release(key: string) {
+    this.keys.delete(key);
+  }
 }
 
 export class InMemoryIssueNumbers extends IssueNumbersRepository {
@@ -189,3 +193,54 @@ export class InMemoryReleaseIssues extends ReleaseIssuesRepository {
     ];
   }
 }
+
+/** Same lookups as the Postgres adapter, over the in-memory events. */
+export class InMemoryTrackerStreams extends TrackerStreamsRepository {
+  constructor(private readonly store: InMemoryEventStore) {
+    super();
+  }
+
+  private streams(
+    type: string,
+    matches: (data: Record<string, unknown>) => boolean,
+  ): string[] {
+    return [
+      ...new Set(
+        this.store.events
+          .filter(
+            (e) =>
+              e.type === type && matches(e.data as Record<string, unknown>),
+          )
+          .map((e) => e.streamId),
+      ),
+    ];
+  }
+
+  async issueIdsOfProject(projectId: string) {
+    return this.streams(
+      'IssueCreatedEvent',
+      (d) => d['projectId'] === projectId,
+    );
+  }
+
+  async releaseIdsOfProject(projectId: string) {
+    return this.streams(
+      'ReleaseCreatedEvent',
+      (d) => d['projectId'] === projectId,
+    );
+  }
+
+  async commentIdsOfIssue(issueId: string) {
+    return this.streams(
+      'CommentAddedEvent',
+      (d) => (d['comment'] as { issueId: string }).issueId === issueId,
+    );
+  }
+
+  async issueIdsLinkingTo(issueId: string) {
+    return this.streams(
+      'IssueLinkedEvent',
+      (d) => (d['link'] as { targetIssueId: string }).targetIssueId === issueId,
+    );
+  }
+}