feat(applicant): self-service visa nationality entry

Add updateMyVisaNationality mutation: finds the caller's AttendingMember where the program has visaStatusVisibleToMembers=true and a VisaApplication exists, updates VisaApplication.nationality, and emits a VISA_NATIONALITY_SELF_SET audit log. Throws NOT_FOUND when no eligible application exists. Tests: persists update; rejects caller without a visible visa app.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/server/routers/applicant.ts

@@ -2937,4 +2937,51 @@ export const applicantRouter = router({
     }
   }),
 
+  /**
+   * Allows the authenticated user to self-declare their passport nationality
+   * on their own VisaApplication when visaStatusVisibleToMembers is true.
+   */
+  updateMyVisaNationality: protectedProcedure
+    .input(z.object({ nationality: z.string().max(100) }))
+    .mutation(async ({ ctx, input }) => {
+      // Find the caller's AttendingMember whose program has visaStatusVisibleToMembers=true
+      // and which has a visaApplication.
+      const attendee = await ctx.prisma.attendingMember.findFirst({
+        where: {
+          userId: ctx.user.id,
+          confirmation: {
+            project: {
+              program: { visaStatusVisibleToMembers: true },
+            },
+          },
+          visaApplication: { isNot: null },
+        },
+        include: { visaApplication: true },
+      })
+
+      if (!attendee || !attendee.visaApplication) {
+        throw new TRPCError({
+          code: 'NOT_FOUND',
+          message: 'No visa application to update',
+        })
+      }
+
+      const updated = await ctx.prisma.visaApplication.update({
+        where: { id: attendee.visaApplication.id },
+        data: { nationality: input.nationality },
+      })
+
+      await logAudit({
+        prisma: ctx.prisma,
+        userId: ctx.user.id,
+        action: 'VISA_NATIONALITY_SELF_SET',
+        entityType: 'VisaApplication',
+        entityId: updated.id,
+        detailsJson: { nationality: input.nationality },
+        ipAddress: ctx.ip,
+        userAgent: ctx.userAgent,
+      })
+
+      return { ok: true }
+    }),
 })