feat: read-only external attendees strip on applicant dashboard

Adds lunch.getProjectExternals (team-member guarded). Strip auto-hides
when no externals attached to the team.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/unit/lunch-router.test.ts

@@ -414,6 +414,49 @@ describe('lunch.exportManifestCsv', () => {
   })
 })
 
+describe('lunch.getProjectExternals', () => {
+  it('returns project-attached externals to a team member', async () => {
+    const program = await createTestProgram({ name: `pe-ok-${uid()}` })
+    programIds.push(program.id)
+    const lead = await createTestUser('APPLICANT')
+    userIds.push(lead.id)
+    const project = await createTestProject(program.id, {
+      title: `pe-${uid()}`, competitionCategory: 'STARTUP',
+    })
+    await prisma.teamMember.create({
+      data: { projectId: project.id, userId: lead.id, role: 'LEAD' },
+    })
+    const event = await prisma.lunchEvent.create({
+      data: { programId: program.id, enabled: true },
+    })
+    await prisma.externalAttendee.create({
+      data: { lunchEventId: event.id, projectId: project.id, name: 'Sponsor X' },
+    })
+    const caller = createCaller(lunchRouter, {
+      id: lead.id, email: lead.email, role: 'APPLICANT',
+    })
+    const result = await caller.getProjectExternals({ projectId: project.id })
+    expect(result).toHaveLength(1)
+    expect(result[0].name).toBe('Sponsor X')
+  })
+
+  it('rejects strangers', async () => {
+    const program = await createTestProgram({ name: `pe-rej-${uid()}` })
+    programIds.push(program.id)
+    const stranger = await createTestUser('APPLICANT')
+    userIds.push(stranger.id)
+    const project = await createTestProject(program.id, {
+      title: `pe-rej-${uid()}`, competitionCategory: 'STARTUP',
+    })
+    const caller = createCaller(lunchRouter, {
+      id: stranger.id, email: stranger.email, role: 'APPLICANT',
+    })
+    await expect(
+      caller.getProjectExternals({ projectId: project.id }),
+    ).rejects.toThrow()
+  })
+})
+
 describe('lunch.updateEvent', () => {
   it('patches an arbitrary subset of fields', async () => {
     const program = await createTestProgram({ name: `lunch-upd-${uid()}` })