feat: formatted text, a list view, ticket details, public proposals and votes

Formatted text
- Descriptions, comments, replies and release notes render Markdown,
  sanitised with DOMPurify (tested against scripts, handlers and
  javascript: links). A pasted image is uploaded and written as
  ![name](attachment:<id>); the web fetches it with the reader's session,
  so it works on private projects. Every text box has a preview. The
  attachment upload now answers its attachmentId.

List view
- /p/:key/list: every ticket as rows, sortable by any column, filtered by
  text, open/closed, type, priority and assignee; status, priority and
  assignee change in place; bulk edit (the backlog's bar, now shared).

Ticket details
- Reactions on comments (GitHub's eight), for members and viewers.
- Duplicate a ticket: what it says, not where it stands.
- blockedBy: open tickets it waits for (BLOCKS / DEPENDS_ON), worked out
  when reading with one query per board or page; shown on cards, list
  rows and the ticket.

Public proposals
- A public project can take bug reports and ideas from anyone
  (acceptsProposals): POST /api/explore/projects/{project}/proposals and
  the form at /p/:key/proponer. They become tickets labelled «propuesta»,
  opened by TaskStream; a honeypot field and 5 per address every 15
  minutes keep spam out. No e-mail is asked: it would be public.

Votes
- Anyone signed in votes on a public project's tickets, members on a
  private one (voteIssue, PUT/DELETE /api/issues/{issue}/vote): votes and
  voted on each ticket, buttons on the ticket and the roadmap, a column
  in the list. The showcase carries votes and the open proposals.

MCP: vote_issue, duplicate_issue, react_to_comment; listings show
blockers and votes. Docs, Word and PDF updated; chat notifications
(Discord, Slack, Telegram) noted for later.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/domain/src/lib/comment/comment.ts

@@ -7,6 +7,10 @@ import {
 import { CommentAddedEvent } from '../events/comment-added.event';
 import { CommentDeletedEvent } from '../events/comment-deleted.event';
 import { CommentEditedEvent } from '../events/comment-edited.event';
+import { CommentReactedEvent } from '../events/comment-reacted.event';
+
+/** The reactions a comment takes, in the order they are shown (GitHub's). */
+export const REACTIONS = ['👍', '👎', '😄', '🎉', '😕', '❤️', '🚀', '👀'];
 
 /** Data of a comment (what CommentAddedEvent carries). */
 export interface CommentProps {
@@ -35,6 +39,8 @@ export class Comment extends VersionedAggregateRoot implements CommentProps {
   public authorId!: string;
   public body!: string;
   public replyTo: string | null = null;
+  /** Who chose each emoji (only the ones somebody chose). */
+  public reactions: Record<string, string[]> = {};
   public deleted = false;
   public createdAt!: string;
   public editedAt: string | null = null;
@@ -62,6 +68,31 @@ export class Comment extends VersionedAggregateRoot implements CommentProps {
     );
   }
 
+  /** Adds (`on`) or takes back the actor's reaction; repeating it changes nothing. */
+  react(actorId: string, emoji: string, on: boolean): void {
+    this.assertAlive();
+    assertThat(
+      REACTIONS.includes(emoji),
+      `Reactions are one of ${REACTIONS.join(' ')}`,
+    );
+    const users = this.reactions[emoji] ?? [];
+    if (on === users.includes(actorId)) return;
+    const next = {
+      ...this.reactions,
+      [emoji]: on ? [...users, actorId] : users.filter((u) => u !== actorId),
+    };
+    if (!next[emoji].length) delete next[emoji];
+    this.apply(
+      new CommentReactedEvent(
+        actorId,
+        this.id,
+        this.projectId,
+        this.issueId,
+        next,
+      ),
+    );
+  }
+
   /** @param canModerate whether the actor manages the project (may delete others' comments). */
   delete(actorId: string, canModerate: boolean): void {
     this.assertAlive();
@@ -86,6 +117,10 @@ export class Comment extends VersionedAggregateRoot implements CommentProps {
     this.editedAt = event.occurredAt;
   }
 
+  onCommentReactedEvent(event: CommentReactedEvent): void {
+    this.reactions = event.reactions;
+  }
+
   onCommentDeletedEvent(): void {
     this.deleted = true;
   }

libs/api/tracker/domain/src/lib/events/comment-reacted.event.ts

@@ -0,0 +1,17 @@
+import { AutowiredEvent } from '@task-stream/api/shared/domain';
+import { TrackerEvent } from './tracker.event';
+
+/** Someone added or took back a reaction (👍…) on a comment. */
+@AutowiredEvent
+export class CommentReactedEvent extends TrackerEvent {
+  constructor(
+    actorId: string,
+    commentId: string,
+    projectId: string,
+    readonly issueId: string,
+    /** Every reaction after the change: who chose each emoji. */
+    readonly reactions: Record<string, string[]>,
+  ) {
+    super(actorId, commentId, projectId);
+  }
+}

libs/api/tracker/domain/src/lib/events/index.ts

@@ -14,6 +14,7 @@ export * from './issue-unlinked.event';
 export * from './issue-release-changed.event';
 export * from './comment-added.event';
 export * from './comment-edited.event';
+export * from './comment-reacted.event';
 export * from './comment-deleted.event';
 export * from './release-created.event';
 export * from './release-updated.event';
@@ -25,6 +26,7 @@ export * from './release-deleted.event';
 export * from './issue-attachment-added.event';
 export * from './issue-attachment-removed.event';
 export * from './issue-watched.event';
+export * from './issue-voted.event';
 export * from './issue-unwatched.event';
 export * from './issue-parent-changed.event';
 export * from './issue-checklist-item-added.event';

libs/api/tracker/domain/src/lib/events/issue-voted.event.ts

@@ -0,0 +1,16 @@
+import { AutowiredEvent } from '@task-stream/api/shared/domain';
+import { TrackerEvent } from './tracker.event';
+
+/** Someone voted for a ticket, or took the vote back. */
+@AutowiredEvent
+export class IssueVotedEvent extends TrackerEvent {
+  constructor(
+    actorId: string,
+    issueId: string,
+    projectId: string,
+    /** Everyone who wants it, after the change. */
+    readonly voterIds: string[],
+  ) {
+    super(actorId, issueId, projectId);
+  }
+}

libs/api/tracker/domain/src/lib/events/project-updated.event.ts

@@ -2,14 +2,17 @@ import { AutowiredEvent } from '@task-stream/api/shared/domain';
 import type { ProjectProps } from '../project/project';
 import { TrackerEvent } from './tracker.event';
 
-/** Name, description or visibility changed. */
+/** Name, description, visibility or whether it takes public proposals changed. */
 @AutowiredEvent
 export class ProjectUpdatedEvent extends TrackerEvent {
   constructor(
     actorId: string,
     projectId: string,
     readonly changes: Partial<
-      Pick<ProjectProps, 'name' | 'description' | 'isPublic'>
+      Pick<
+        ProjectProps,
+        'name' | 'description' | 'isPublic' | 'acceptsProposals'
+      >
     >,
   ) {
     super(actorId, projectId, projectId);

libs/api/tracker/domain/src/lib/issue/issue.ts

@@ -25,6 +25,7 @@ import { IssueUnlinkedEvent } from '../events/issue-unlinked.event';
 import { IssueUpdatedEvent } from '../events/issue-updated.event';
 import { IssueUnwatchedEvent } from '../events/issue-unwatched.event';
 import { IssueWatchedEvent } from '../events/issue-watched.event';
+import { IssueVotedEvent } from '../events/issue-voted.event';
 import { ProjectWorkflow } from '../project/project-settings';
 import {
   IssueAttachment,
@@ -116,6 +117,8 @@ export class Issue extends VersionedAggregateRoot implements IssueProps {
   public attachments: IssueAttachment[] = [];
   /** People who asked to be told about this ticket. */
   public watchers: string[] = [];
+  /** People who want it done (a public roadmap's way to prioritise). */
+  public voterIds: string[] = [];
   /** The epic or ticket this one breaks down. */
   public parentId: string | null = null;
   public checklist: ChecklistItem[] = [];
@@ -337,6 +340,21 @@ export class Issue extends VersionedAggregateRoot implements IssueProps {
     );
   }
 
+  /** The actor votes for it (`on`) or takes the vote back. Idempotent. */
+  vote(actorId: string, on: boolean): void {
+    if (on === this.voterIds.includes(actorId)) return;
+    this.apply(
+      new IssueVotedEvent(
+        actorId,
+        this.id,
+        this.projectId,
+        on
+          ? [...this.voterIds, actorId]
+          : this.voterIds.filter((id) => id !== actorId),
+      ),
+    );
+  }
+
   /** `userId` starts following the ticket. Idempotent. */
   watch(actorId: string, userId: string): void {
     if (this.watchers.includes(userId)) return;
@@ -553,6 +571,10 @@ export class Issue extends VersionedAggregateRoot implements IssueProps {
     this.updatedAt = event.occurredAt;
   }
 
+  onIssueVotedEvent(event: IssueVotedEvent): void {
+    this.voterIds = event.voterIds;
+  }
+
   onIssueWatchedEvent(event: IssueWatchedEvent): void {
     this.watchers = [...this.watchers, event.userId];
   }

libs/api/tracker/domain/src/lib/project/project.ts

@@ -32,6 +32,11 @@ export interface ProjectProps {
   description: string | null;
   /** Anyone (even without signing in) can read it. Absent in old projects: private. */
   isPublic?: boolean;
+  /**
+   * Takes bug reports and ideas from anyone, through a public form (only
+   * while it is public). Absent in old projects: no.
+   */
+  acceptsProposals?: boolean;
   ownerId: string;
   members: ProjectMember[];
   /** Absent in projects created before settings existed: defaults apply. */
@@ -49,6 +54,7 @@ export class Project extends VersionedAggregateRoot implements ProjectProps {
   public name!: string;
   public description: string | null = null;
   public isPublic = false;
+  public acceptsProposals = false;
   public ownerId!: string;
   public members: ProjectMember[] = [];
   public settings: ProjectSettings = defaultProjectSettings();
@@ -104,13 +110,19 @@ export class Project extends VersionedAggregateRoot implements ProjectProps {
 
   updateDetails(
     actorId: string,
-    changes: { name?: string; description?: string | null; isPublic?: boolean },
+    changes: {
+      name?: string;
+      description?: string | null;
+      isPublic?: boolean;
+      acceptsProposals?: boolean;
+    },
   ): void {
     this.assertCanManage(actorId);
     const patch: {
       name?: string;
       description?: string | null;
       isPublic?: boolean;
+      acceptsProposals?: boolean;
     } = {};
     if (changes.name !== undefined) {
       const name = changes.name.trim();
@@ -123,6 +135,11 @@ export class Project extends VersionedAggregateRoot implements ProjectProps {
     }
     if (changes.isPublic !== undefined && changes.isPublic !== this.isPublic)
       patch.isPublic = changes.isPublic;
+    if (
+      changes.acceptsProposals !== undefined &&
+      changes.acceptsProposals !== this.acceptsProposals
+    )
+      patch.acceptsProposals = changes.acceptsProposals;
     if (Object.keys(patch).length === 0) return;
     this.apply(new ProjectUpdatedEvent(actorId, this.id, patch));
   }
@@ -213,6 +230,7 @@ export class Project extends VersionedAggregateRoot implements ProjectProps {
     this.name = project.name;
     this.description = project.description;
     this.isPublic = project.isPublic ?? false;
+    this.acceptsProposals = project.acceptsProposals ?? false;
     this.ownerId = project.ownerId;
     this.members = project.members.map((m) => ({ ...m }));
     this.settings = structuredClone(

libs/api/tracker/domain/src/lib/read-models/comment.read-model.ts

@@ -1,5 +1,11 @@
 import { UserRefReadModel } from './user-ref.read-model';
 
+/** One emoji on a comment and who chose it. */
+export class CommentReactionReadModel {
+  emoji!: string;
+  users!: UserRefReadModel[];
+}
+
 export class CommentReadModel {
   id!: string;
   issueId!: string;
@@ -13,6 +19,8 @@ export class CommentReadModel {
    * conversation under it still makes sense. Gone with its last reply.
    */
   deleted!: boolean;
+  /** In the order they are offered; only the ones somebody chose. */
+  reactions!: CommentReactionReadModel[];
   createdAt!: string;
   editedAt!: string | null;
   version!: number;

libs/api/tracker/domain/src/lib/read-models/issue.read-model.ts

@@ -81,6 +81,10 @@ export class IssueReadModel {
   attachments!: AttachmentReadModel[];
   /** People following the ticket. */
   watchers!: UserRefReadModel[];
+  /** How many want it done. */
+  votes!: number;
+  /** Who voted: to tell someone whether they did; never shown as a list. */
+  voterIds!: string[];
   parent!: IssueParentReadModel | null;
   /** Place in the backlog (and in each board column): ascending. */
   rank!: string;

libs/api/tracker/domain/src/lib/read-models/project.read-model.ts

@@ -14,6 +14,8 @@ export class ProjectReadModel {
   description!: string | null;
   /** Readable by anyone, also without signing in. */
   isPublic!: boolean;
+  /** Takes bug reports and ideas from anyone (only while public). */
+  acceptsProposals!: boolean;
   owner!: UserRefReadModel;
   members!: ProjectMemberReadModel[];
   /** Statuses, transitions, ticket types and areas. */