feat(applicant): self-service visa nationality entry

Add updateMyVisaNationality mutation: finds the caller's AttendingMember where the program has visaStatusVisibleToMembers=true and a VisaApplication exists, updates VisaApplication.nationality, and emits a VISA_NATIONALITY_SELF_SET audit log. Throws NOT_FOUND when no eligible application exists. Tests: persists update; rejects caller without a visible visa app.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/unit/applicant-my-logistics.test.ts

@@ -212,3 +212,65 @@ describe('applicant.getMyLogistics', () => {
     expect(result).toBeNull()
   })
 })
+
+// ─── Task 2 tests ──────────────────────────────────────────────────────────
+
+describe('applicant.updateMyVisaNationality', () => {
+  const programIds: string[] = []
+  const userIds: string[] = []
+
+  afterAll(async () => {
+    for (const programId of programIds) {
+      await prisma.visaApplication.deleteMany({
+        where: { attendingMember: { confirmation: { project: { programId } } } },
+      })
+      await prisma.flightDetail.deleteMany({
+        where: { attendingMember: { confirmation: { project: { programId } } } },
+      })
+      await prisma.hotel.deleteMany({ where: { programId } })
+      await prisma.attendingMember.deleteMany({
+        where: { confirmation: { project: { programId } } },
+      })
+      await prisma.finalistConfirmation.deleteMany({ where: { project: { programId } } })
+      await cleanupTestData(programId, [])
+    }
+    if (userIds.length > 0) {
+      await prisma.user.deleteMany({ where: { id: { in: userIds } } })
+    }
+  })
+
+  it('updates VisaApplication.nationality and persists it', async () => {
+    const { program, user, attendee } = await buildConfirmedFinalist()
+    programIds.push(program.id)
+    userIds.push(user.id)
+
+    const caller = createCaller(applicantRouter, {
+      id: user.id,
+      email: user.email,
+      role: 'APPLICANT',
+    })
+
+    const result = await caller.updateMyVisaNationality({ nationality: 'Kenya' })
+    expect(result).toEqual({ ok: true })
+
+    const updated = await prisma.visaApplication.findUnique({
+      where: { attendingMemberId: attendee.id },
+    })
+    expect(updated!.nationality).toBe('Kenya')
+  })
+
+  it('throws NOT_FOUND when the caller has no visible visa application', async () => {
+    const nonVisa = await createApplicant()
+    userIds.push(nonVisa.id)
+
+    const caller = createCaller(applicantRouter, {
+      id: nonVisa.id,
+      email: nonVisa.email,
+      role: 'APPLICANT',
+    })
+
+    await expect(
+      caller.updateMyVisaNationality({ nationality: 'Kenya' }),
+    ).rejects.toMatchObject({ code: 'NOT_FOUND' })
+  })
+})