feat: dish CRUD on lunch router

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/server/routers/lunch.ts

@@ -34,6 +34,101 @@ export const lunchRouter = router({
       return ctx.prisma.lunchEvent.create({ data: { programId: input.programId } })
     }),
 
+  // ─── Dish CRUD ────────────────────────────────────────────────────────────
+
+  listDishes: adminProcedure
+    .input(z.object({ lunchEventId: z.string() }))
+    .query(({ ctx, input }) =>
+      ctx.prisma.dish.findMany({
+        where: { lunchEventId: input.lunchEventId },
+        orderBy: [{ sortOrder: 'asc' }, { createdAt: 'asc' }],
+      }),
+    ),
+
+  createDish: adminProcedure
+    .input(
+      z.object({
+        lunchEventId: z.string(),
+        name: z.string().min(1).max(200),
+        dietaryTags,
+        sortOrder: z.number().int().optional(),
+      }),
+    )
+    .mutation(async ({ ctx, input }) => {
+      const dish = await ctx.prisma.dish.create({
+        data: {
+          lunchEventId: input.lunchEventId,
+          name: input.name,
+          dietaryTags: input.dietaryTags,
+          sortOrder: input.sortOrder ?? 0,
+        },
+      })
+      await logAudit({
+        prisma: ctx.prisma,
+        userId: ctx.user.id,
+        action: 'LUNCH_DISH_CREATED',
+        entityType: 'Dish',
+        entityId: dish.id,
+        detailsJson: { name: dish.name, dietaryTags: dish.dietaryTags },
+      })
+      return dish
+    }),
+
+  updateDish: adminProcedure
+    .input(
+      z.object({
+        dishId: z.string(),
+        name: z.string().min(1).max(200).optional(),
+        dietaryTags: dietaryTags.optional(),
+        sortOrder: z.number().int().optional(),
+      }),
+    )
+    .mutation(async ({ ctx, input }) => {
+      const { dishId, ...patch } = input
+      const dish = await ctx.prisma.dish.update({ where: { id: dishId }, data: patch })
+      await logAudit({
+        prisma: ctx.prisma,
+        userId: ctx.user.id,
+        action: 'LUNCH_DISH_UPDATED',
+        entityType: 'Dish',
+        entityId: dish.id,
+        detailsJson: patch as Record<string, unknown>,
+      })
+      return dish
+    }),
+
+  deleteDish: adminProcedure
+    .input(z.object({ dishId: z.string() }))
+    .mutation(async ({ ctx, input }) => {
+      const dish = await ctx.prisma.dish.delete({ where: { id: input.dishId } })
+      await logAudit({
+        prisma: ctx.prisma,
+        userId: ctx.user.id,
+        action: 'LUNCH_DISH_DELETED',
+        entityType: 'Dish',
+        entityId: dish.id,
+        detailsJson: { name: dish.name },
+      })
+      return { ok: true as const }
+    }),
+
+  reorderDishes: adminProcedure
+    .input(
+      z.object({
+        ordered: z.array(
+          z.object({ dishId: z.string(), sortOrder: z.number().int() }),
+        ),
+      }),
+    )
+    .mutation(async ({ ctx, input }) => {
+      await ctx.prisma.$transaction(
+        input.ordered.map(({ dishId, sortOrder }) =>
+          ctx.prisma.dish.update({ where: { id: dishId }, data: { sortOrder } }),
+        ),
+      )
+      return { ok: true as const }
+    }),
+
   /** Patch any subset of LunchEvent config fields. Audit-logged. */
   updateEvent: adminProcedure
     .input(