feat(logistics): external attendees self-select lunch dish via tokenized page

External lunch attendees had no way to pick their own dish — an admin had to set
it inline and no email was ever sent. (Marine added herself as an external
expecting a dish-selection link and never received one.)

Adds:
- ExternalAttendee.inviteSentAt + additive migration
- HMAC-signed external lunch token (mirrors finalist-token)
- Public no-login picker page /lunch/pick/[token] — dish + allergens + notes,
  gated by the lunch change deadline, read-only after
- tRPC getExternalByToken / setExternalPick (public) + sendExternalInvite (admin)
- Auto-send invite on createExternal when an email is present; per-row resend
  button + status chip (Invited / Picked / no email) in the logistics screen
- Unpicked externals chased by the lunch reminder cron + manual "Send reminders"
- sendExternalDishInviteEmail (branded). Page + email title use the configurable
  venue ("Lunch at {venue}") rather than "grand finale"

Tests: token roundtrip/tamper/expiry, selectUnpickedExternals filter,
get/set-by-token happy + deadline + bad-token, createExternal auto-send,
cron external reminders. Full suite 303 passing; build clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/components/admin/logistics/lunch-externals.tsx

@@ -22,7 +22,8 @@ import {
   DialogTitle,
   DialogFooter,
 } from '@/components/ui/dialog'
-import { Plus, Pencil, Trash2 } from 'lucide-react'
+import { Badge } from '@/components/ui/badge'
+import { Plus, Pencil, Trash2, Mail, MailCheck, Utensils } from 'lucide-react'
 import { toast } from 'sonner'
 
 const ALLERGENS = [
@@ -90,6 +91,13 @@ export const LunchExternals = forwardRef<
     onSuccess: invalidateAll,
     onError: (e) => toast.error(e.message),
   })
+  const sendInvite = trpc.lunch.sendExternalInvite.useMutation({
+    onSuccess: () => {
+      invalidateAll()
+      toast.success('Dish invite sent')
+    },
+    onError: (e) => toast.error(e.message),
+  })
 
   const editingRow =
     editing?.mode === 'edit'
@@ -123,7 +131,40 @@ export const LunchExternals = forwardRef<
                       {e.project?.title ?? 'Standalone'}
                     </td>
                     <td className="text-muted-foreground">{e.roleNote ?? ''}</td>
+                    <td>
+                      {e.dishId ? (
+                        <Badge variant="secondary" className="gap-1">
+                          <Utensils className="h-3 w-3" /> Picked
+                        </Badge>
+                      ) : !e.email ? (
+                        <Badge variant="outline" className="text-muted-foreground">
+                          No email
+                        </Badge>
+                      ) : e.inviteSentAt ? (
+                        <Badge variant="outline" className="gap-1">
+                          <MailCheck className="h-3 w-3" /> Invited
+                        </Badge>
+                      ) : (
+                        <Badge variant="outline" className="text-muted-foreground">
+                          Not invited
+                        </Badge>
+                      )}
+                    </td>
                     <td className="text-right">
+                      {e.email && !e.dishId && (
+                        <Button
+                          size="sm"
+                          variant="ghost"
+                          title={e.inviteSentAt ? 'Resend dish invite' : 'Send dish invite'}
+                          disabled={
+                            sendInvite.isPending &&
+                            sendInvite.variables?.externalId === e.id
+                          }
+                          onClick={() => sendInvite.mutate({ externalId: e.id })}
+                        >
+                          <Mail className="h-4 w-4" />
+                        </Button>
+                      )}
                       <Button
                         size="sm"
                         variant="ghost"