feat: admin visa CRUD procedures

logistics router gains three procedures for the Visas tab:
  - listVisaApplications: program-scoped, joined with project + attendee,
    sorted by status priority (REQUESTED first → NOT_NEEDED last).
  - updateVisaApplication: partial update of status / dates / nationality /
    notes; clears nullable fields on null. Audit-logged as VISA_UPDATE
    with previous + next snapshots.
  - setVisaVisibility: flips Program.visaStatusVisibleToMembers. Audit-
    logged as VISA_VISIBILITY_SET.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/server/routers/logistics.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod'
-import { FlightDetailStatus } from '@prisma/client'
+import { FlightDetailStatus, VisaStatus } from '@prisma/client'
+import { TRPCError } from '@trpc/server'
 import { router, adminProcedure } from '../trpc'
 import { logAudit } from '../utils/audit'
 
@@ -199,4 +200,141 @@ export const logisticsRouter = router({
       })
       return detail
     }),
+
+  /**
+   * List all VisaApplication rows for a program, joined with the project +
+   * attendee + project so the admin Visas tab can render a flat table.
+   * Sorted by status priority (REQUESTED first → resolved last) so the most
+   * urgent in-flight applications surface at the top.
+   */
+  listVisaApplications: adminProcedure
+    .input(z.object({ programId: z.string() }))
+    .query(async ({ ctx, input }) => {
+      const rows = await ctx.prisma.visaApplication.findMany({
+        where: {
+          attendingMember: {
+            confirmation: { project: { programId: input.programId } },
+          },
+        },
+        include: {
+          attendingMember: {
+            include: {
+              user: { select: { id: true, name: true, email: true } },
+              confirmation: {
+                select: {
+                  id: true,
+                  project: { select: { id: true, title: true } },
+                },
+              },
+            },
+          },
+        },
+      })
+      const STATUS_PRIORITY: Record<VisaStatus, number> = {
+        REQUESTED: 0,
+        INVITATION_SENT: 1,
+        APPOINTMENT_BOOKED: 2,
+        GRANTED: 3,
+        DENIED: 4,
+        NOT_NEEDED: 5,
+      }
+      return rows
+        .map((r) => ({
+          id: r.id,
+          status: r.status,
+          nationality: r.nationality,
+          invitationSentAt: r.invitationSentAt,
+          appointmentAt: r.appointmentAt,
+          decisionAt: r.decisionAt,
+          notes: r.notes,
+          updatedAt: r.updatedAt,
+          attendee: {
+            id: r.attendingMember.id,
+            user: r.attendingMember.user,
+          },
+          project: r.attendingMember.confirmation.project,
+        }))
+        .sort((a, b) => {
+          const sa = STATUS_PRIORITY[a.status] ?? 9
+          const sb = STATUS_PRIORITY[b.status] ?? 9
+          if (sa !== sb) return sa - sb
+          return a.project.title.localeCompare(b.project.title)
+        })
+    }),
+
+  /**
+   * Update a VisaApplication's status, dates, nationality, and notes. Empty
+   * date fields clear the value. Audit-logged as VISA_UPDATE.
+   */
+  updateVisaApplication: adminProcedure
+    .input(
+      z.object({
+        id: z.string(),
+        status: z.nativeEnum(VisaStatus).optional(),
+        nationality: z.string().max(100).optional().nullable(),
+        invitationSentAt: z.date().optional().nullable(),
+        appointmentAt: z.date().optional().nullable(),
+        decisionAt: z.date().optional().nullable(),
+        notes: z.string().max(2000).optional().nullable(),
+      }),
+    )
+    .mutation(async ({ ctx, input }) => {
+      const existing = await ctx.prisma.visaApplication.findUnique({
+        where: { id: input.id },
+      })
+      if (!existing) {
+        throw new TRPCError({ code: 'NOT_FOUND', message: 'Visa application not found' })
+      }
+      const data: Record<string, unknown> = {}
+      if (input.status !== undefined) data.status = input.status
+      if (input.nationality !== undefined) data.nationality = input.nationality
+      if (input.invitationSentAt !== undefined) data.invitationSentAt = input.invitationSentAt
+      if (input.appointmentAt !== undefined) data.appointmentAt = input.appointmentAt
+      if (input.decisionAt !== undefined) data.decisionAt = input.decisionAt
+      if (input.notes !== undefined) data.notes = input.notes
+      const updated = await ctx.prisma.visaApplication.update({
+        where: { id: input.id },
+        data,
+      })
+      await logAudit({
+        prisma: ctx.prisma,
+        userId: ctx.user.id,
+        action: 'VISA_UPDATE',
+        entityType: 'VisaApplication',
+        entityId: updated.id,
+        detailsJson: {
+          previous: {
+            status: existing.status,
+            nationality: existing.nationality,
+            invitationSentAt: existing.invitationSentAt,
+            appointmentAt: existing.appointmentAt,
+            decisionAt: existing.decisionAt,
+          },
+          next: data,
+        },
+      })
+      return updated
+    }),
+
+  /**
+   * Flip Program.visaStatusVisibleToMembers. Controls whether the team can
+   * see their own visa status on the applicant dashboard.
+   */
+  setVisaVisibility: adminProcedure
+    .input(z.object({ programId: z.string(), visible: z.boolean() }))
+    .mutation(async ({ ctx, input }) => {
+      const program = await ctx.prisma.program.update({
+        where: { id: input.programId },
+        data: { visaStatusVisibleToMembers: input.visible },
+      })
+      await logAudit({
+        prisma: ctx.prisma,
+        userId: ctx.user.id,
+        action: 'VISA_VISIBILITY_SET',
+        entityType: 'Program',
+        entityId: program.id,
+        detailsJson: { visible: input.visible },
+      })
+      return { visible: program.visaStatusVisibleToMembers }
+    }),
 })