feat(logistics): external attendees self-select lunch dish via tokenized page

External lunch attendees had no way to pick their own dish — an admin had to set
it inline and no email was ever sent. (Marine added herself as an external
expecting a dish-selection link and never received one.)

Adds:
- ExternalAttendee.inviteSentAt + additive migration
- HMAC-signed external lunch token (mirrors finalist-token)
- Public no-login picker page /lunch/pick/[token] — dish + allergens + notes,
  gated by the lunch change deadline, read-only after
- tRPC getExternalByToken / setExternalPick (public) + sendExternalInvite (admin)
- Auto-send invite on createExternal when an email is present; per-row resend
  button + status chip (Invited / Picked / no email) in the logistics screen
- Unpicked externals chased by the lunch reminder cron + manual "Send reminders"
- sendExternalDishInviteEmail (branded). Page + email title use the configurable
  venue ("Lunch at {venue}") rather than "grand finale"

Tests: token roundtrip/tamper/expiry, selectUnpickedExternals filter,
get/set-by-token happy + deadline + bad-token, createExternal auto-send,
cron external reminders. Full suite 303 passing; build clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/app/api/cron/lunch-reminders/route.ts

@@ -1,7 +1,11 @@
 import { NextResponse, type NextRequest } from 'next/server'
 import { prisma } from '@/lib/prisma'
 import { sendLunchReminderEmail } from '@/lib/email'
-import { selectUnpickedAttendees } from '@/server/services/lunch-reminders'
+import {
+  selectUnpickedAttendees,
+  selectUnpickedExternals,
+} from '@/server/services/lunch-reminders'
+import { sendExternalDishInvite } from '@/server/services/lunch-external-invite'
 
 /**
  * Cron: send a single reminder email per attending member who hasn't picked
@@ -53,6 +57,19 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
           console.error('[lunch-reminders] send failed for', am.user.email, e)
         }
       }
+
+      // External attendees: emailed + no dish yet → their tokenized pick page.
+      const externals = await selectUnpickedExternals(prisma, { id: event.id })
+      for (const ext of externals) {
+        if (!ext.email) continue
+        try {
+          await sendExternalDishInvite(prisma, ext, event)
+          sent++
+        } catch (e) {
+          console.error('[lunch-reminders] external send failed for', ext.email, e)
+        }
+      }
+
       await prisma.lunchEvent.update({
         where: { id: event.id },
         data: { reminderSentAt: new Date() },