feat: read-only external attendees strip on applicant dashboard

Adds lunch.getProjectExternals (team-member guarded). Strip auto-hides
when no externals attached to the team.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/server/routers/lunch.ts

@@ -398,6 +398,29 @@ export const lunchRouter = router({
       return { ...event, changeDeadline }
     }),
 
+  /**
+   * Read-only list of project-attached externals for a project. Visible to
+   * any team member of the project (so they know who's joining their lunch).
+   */
+  getProjectExternals: protectedProcedure
+    .input(z.object({ projectId: z.string() }))
+    .query(async ({ ctx, input }) => {
+      const userId = ctx.user.id
+      const role = ctx.user.role
+      const isAdmin = role === 'SUPER_ADMIN' || role === 'PROGRAM_ADMIN'
+      if (!isAdmin) {
+        const tm = await ctx.prisma.teamMember.findFirst({
+          where: { projectId: input.projectId, userId },
+        })
+        if (!tm) throw new TRPCError({ code: 'FORBIDDEN' })
+      }
+      return ctx.prisma.externalAttendee.findMany({
+        where: { projectId: input.projectId },
+        include: { dish: true },
+        orderBy: { createdAt: 'asc' },
+      })
+    }),
+
   /**
    * All picks for the caller's team. Within-team transparency: every team
    * member sees their teammates' picks (lunch picks aren't sensitive).