feat: formatted text, a list view, ticket details, public proposals and votes

Formatted text
- Descriptions, comments, replies and release notes render Markdown,
  sanitised with DOMPurify (tested against scripts, handlers and
  javascript: links). A pasted image is uploaded and written as
  ![name](attachment:<id>); the web fetches it with the reader's session,
  so it works on private projects. Every text box has a preview. The
  attachment upload now answers its attachmentId.

List view
- /p/:key/list: every ticket as rows, sortable by any column, filtered by
  text, open/closed, type, priority and assignee; status, priority and
  assignee change in place; bulk edit (the backlog's bar, now shared).

Ticket details
- Reactions on comments (GitHub's eight), for members and viewers.
- Duplicate a ticket: what it says, not where it stands.
- blockedBy: open tickets it waits for (BLOCKS / DEPENDS_ON), worked out
  when reading with one query per board or page; shown on cards, list
  rows and the ticket.

Public proposals
- A public project can take bug reports and ideas from anyone
  (acceptsProposals): POST /api/explore/projects/{project}/proposals and
  the form at /p/:key/proponer. They become tickets labelled «propuesta»,
  opened by TaskStream; a honeypot field and 5 per address every 15
  minutes keep spam out. No e-mail is asked: it would be public.

Votes
- Anyone signed in votes on a public project's tickets, members on a
  private one (voteIssue, PUT/DELETE /api/issues/{issue}/vote): votes and
  voted on each ticket, buttons on the ticket and the roadmap, a column
  in the list. The showcase carries votes and the open proposals.

MCP: vote_issue, duplicate_issue, react_to_comment; listings show
blockers and votes. Docs, Word and PDF updated; chat notifications
(Discord, Slack, Telegram) noted for later.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/presenters/src/lib/http/comments.controller.ts

@@ -1,4 +1,12 @@
-import { Body, Controller, Delete, Param, Patch } from '@nestjs/common';
+import {
+  Body,
+  Controller,
+  Delete,
+  HttpCode,
+  Param,
+  Patch,
+  Post,
+} from '@nestjs/common';
 import { ApiOkResponse, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { User } from '@task-stream/api/identity/domain';
 import {
@@ -7,7 +15,8 @@ import {
 } from '@task-stream/api/identity/presenters';
 import { ApiCommandErrors } from '@task-stream/api/shared/presenters';
 import { CommentsService } from '@task-stream/api/tracker/application';
-import { CommentBodyDto } from './dto/requests.dto';
+import { REACTIONS } from '@task-stream/api/tracker/domain';
+import { CommentBodyDto, ReactToCommentDto } from './dto/requests.dto';
 import { CommandResultDto } from './dto/responses.dto';
 
 /** REST adapter of the comment use cases (listing and adding live under /issues). */
@@ -29,6 +38,22 @@ export class CommentsController {
     return this.comments.edit(me.id, commentId, body.body);
   }
 
+  @Post(':commentId/reactions')
+  @HttpCode(200)
+  @ApiOperation({
+    summary: 'React to a comment, or take the reaction back (members)',
+    description: `One of ${REACTIONS.join(' ')}; repeating it changes nothing.`,
+  })
+  @ApiOkResponse({ type: CommandResultDto })
+  @ApiCommandErrors()
+  react(
+    @CurrentUser() me: User,
+    @Param('commentId') commentId: string,
+    @Body() body: ReactToCommentDto,
+  ) {
+    return this.comments.react(me.id, commentId, body.emoji, body.on);
+  }
+
   @Delete(':commentId')
   @ApiOperation({ summary: 'Delete a comment (author or project admin)' })
   @ApiOkResponse({ type: CommandResultDto })