feat: formatted text, a list view, ticket details, public proposals and votes

Formatted text
- Descriptions, comments, replies and release notes render Markdown,
  sanitised with DOMPurify (tested against scripts, handlers and
  javascript: links). A pasted image is uploaded and written as
  ![name](attachment:<id>); the web fetches it with the reader's session,
  so it works on private projects. Every text box has a preview. The
  attachment upload now answers its attachmentId.

List view
- /p/:key/list: every ticket as rows, sortable by any column, filtered by
  text, open/closed, type, priority and assignee; status, priority and
  assignee change in place; bulk edit (the backlog's bar, now shared).

Ticket details
- Reactions on comments (GitHub's eight), for members and viewers.
- Duplicate a ticket: what it says, not where it stands.
- blockedBy: open tickets it waits for (BLOCKS / DEPENDS_ON), worked out
  when reading with one query per board or page; shown on cards, list
  rows and the ticket.

Public proposals
- A public project can take bug reports and ideas from anyone
  (acceptsProposals): POST /api/explore/projects/{project}/proposals and
  the form at /p/:key/proponer. They become tickets labelled «propuesta»,
  opened by TaskStream; a honeypot field and 5 per address every 15
  minutes keep spam out. No e-mail is asked: it would be public.

Votes
- Anyone signed in votes on a public project's tickets, members on a
  private one (voteIssue, PUT/DELETE /api/issues/{issue}/vote): votes and
  voted on each ticket, buttons on the ticket and the roadmap, a column
  in the list. The showcase carries votes and the open proposals.

MCP: vote_issue, duplicate_issue, react_to_comment; listings show
blockers and votes. Docs, Word and PDF updated; chat notifications
(Discord, Slack, Telegram) noted for later.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/presenters/src/lib/http/proposal-limiter.ts

@@ -0,0 +1,33 @@
+import { HttpException, HttpStatus, Injectable } from '@nestjs/common';
+
+/** Proposals from one address within the window. */
+const LIMIT = 5;
+const WINDOW_MS = 15 * 60_000;
+
+/**
+ * Keeps one address from flooding a project with proposals. In memory:
+ * enough for one instance, and an approximation with several (each counts
+ * its own), which is fine for what it guards against.
+ */
+@Injectable()
+export class ProposalLimiter {
+  private readonly sent = new Map<string, number[]>();
+
+  take(address: string): void {
+    const now = Date.now();
+    const recent = (this.sent.get(address) ?? []).filter(
+      (at) => now - at < WINDOW_MS,
+    );
+    if (recent.length >= LIMIT)
+      throw new HttpException(
+        'Too many proposals from here; try again in a few minutes',
+        HttpStatus.TOO_MANY_REQUESTS,
+      );
+    recent.push(now);
+    this.sent.set(address, recent);
+    // Forget quiet addresses now and then, so the map does not grow forever.
+    if (this.sent.size > 10_000)
+      for (const [key, times] of this.sent)
+        if (times.every((at) => now - at >= WINDOW_MS)) this.sent.delete(key);
+  }
+}