feat(logistics): external attendees self-select lunch dish via tokenized page

External lunch attendees had no way to pick their own dish — an admin had to set
it inline and no email was ever sent. (Marine added herself as an external
expecting a dish-selection link and never received one.)

Adds:
- ExternalAttendee.inviteSentAt + additive migration
- HMAC-signed external lunch token (mirrors finalist-token)
- Public no-login picker page /lunch/pick/[token] — dish + allergens + notes,
  gated by the lunch change deadline, read-only after
- tRPC getExternalByToken / setExternalPick (public) + sendExternalInvite (admin)
- Auto-send invite on createExternal when an email is present; per-row resend
  button + status chip (Invited / Picked / no email) in the logistics screen
- Unpicked externals chased by the lunch reminder cron + manual "Send reminders"
- sendExternalDishInviteEmail (branded). Page + email title use the configurable
  venue ("Lunch at {venue}") rather than "grand finale"

Tests: token roundtrip/tamper/expiry, selectUnpickedExternals filter,
get/set-by-token happy + deadline + bad-token, createExternal auto-send,
cron external reminders. Full suite 303 passing; build clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/lunch-cron.test.ts

@@ -14,6 +14,7 @@ vi.mock('@/lib/email', async () => {
     ...actual,
     sendLunchReminderEmail: vi.fn(async () => undefined),
     sendLunchRecapEmail: vi.fn(async () => undefined),
+    sendExternalDishInviteEmail: vi.fn(async () => undefined),
   }
 })
 
@@ -29,6 +30,7 @@ afterAll(async () => {
       where: { confirmation: { project: { programId } } },
     })
     await prisma.finalistConfirmation.deleteMany({ where: { project: { programId } } })
+    await prisma.externalAttendee.deleteMany({ where: { lunchEvent: { programId } } })
     await prisma.dish.deleteMany({ where: { lunchEvent: { programId } } })
     await prisma.lunchEvent.deleteMany({ where: { programId } })
     await cleanupTestData(programId, [])
@@ -58,6 +60,7 @@ describe('GET /api/cron/lunch-reminders', () => {
   beforeEach(async () => {
     vi.clearAllMocks()
     if (!process.env.CRON_SECRET) process.env.CRON_SECRET = 'test-secret'
+    if (!process.env.NEXTAUTH_SECRET) process.env.NEXTAUTH_SECRET = 'test-secret-nextauth'
   })
 
   it('rejects without CRON_SECRET', async () => {
@@ -119,6 +122,33 @@ describe('GET /api/cron/lunch-reminders', () => {
     expect(row?.reminderSentAt).not.toBeNull()
   })
 
+  it('sends dish invites to unpicked external attendees inside the window', async () => {
+    const program = await createTestProgram({ name: `cron-rmd-ext-${uid()}` })
+    programIds.push(program.id)
+    const eventAt = new Date(Date.now() + 25 * 3_600_000)
+    const event = await prisma.lunchEvent.create({
+      data: {
+        programId: program.id,
+        enabled: true,
+        eventAt,
+        venue: 'La Terrasse',
+        changeCutoffHours: 24,
+        reminderHoursBeforeDeadline: 4,
+      },
+    })
+    // emailed + no dish → invited; no-email → skipped
+    await prisma.externalAttendee.create({
+      data: { lunchEventId: event.id, name: 'Emailed Guest', email: `ext-${uid()}@x.test` },
+    })
+    await prisma.externalAttendee.create({
+      data: { lunchEventId: event.id, name: 'No Email Guest' },
+    })
+    const res = await callCron('lunch-reminders')
+    expect(res.status).toBe(200)
+    const { sendExternalDishInviteEmail } = await import('@/lib/email')
+    expect(sendExternalDishInviteEmail).toHaveBeenCalledTimes(1)
+  })
+
   it('is idempotent — re-running with reminderSentAt set does not resend', async () => {
     const program = await createTestProgram({ name: `cron-rmd-idem-${uid()}` })
     programIds.push(program.id)