feat: lunch manifest query + CSV export

Adds buildManifest service shared between getManifest and the recap.
CSV escaper handles commas/quotes/newlines for safe spreadsheet import.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/unit/lunch-router.test.ts

@@ -330,6 +330,90 @@ describe('lunch.getTeamPicks', () => {
   })
 })
 
+describe('lunch.getManifest', () => {
+  it('returns confirmed attending members + externals with merged shape', async () => {
+    const program = await createTestProgram({ name: `mfst-${uid()}` })
+    programIds.push(program.id)
+    const { caller } = await newAdminCaller()
+    const m = await createTestUser('APPLICANT')
+    userIds.push(m.id)
+    const project = await createTestProject(program.id, {
+      title: `mfst-${uid()}`, competitionCategory: 'STARTUP',
+    })
+    const conf = await prisma.finalistConfirmation.create({
+      data: {
+        projectId: project.id, category: 'STARTUP', status: 'CONFIRMED',
+        deadline: new Date(Date.now() + 86_400_000), token: `tok-${uid()}`,
+      },
+    })
+    const am = await prisma.attendingMember.create({
+      data: { confirmationId: conf.id, userId: m.id },
+    })
+    const event = await prisma.lunchEvent.create({
+      data: { programId: program.id, enabled: true },
+    })
+    const dish = await prisma.dish.create({
+      data: { lunchEventId: event.id, name: 'Risotto', dietaryTags: ['VEGETARIAN'] },
+    })
+    await prisma.memberLunchPick.create({
+      data: { attendingMemberId: am.id, dishId: dish.id, pickedAt: new Date() },
+    })
+    await prisma.externalAttendee.create({
+      data: { lunchEventId: event.id, name: 'External Bob', dishId: dish.id },
+    })
+    const manifest = await caller.getManifest({ programId: program.id })
+    expect(manifest.members).toHaveLength(1)
+    expect(manifest.externals).toHaveLength(1)
+    expect(manifest.summary.picked).toBe(2)
+    expect(manifest.summary.missing).toBe(0)
+  })
+
+  it('excludes non-CONFIRMED confirmations', async () => {
+    const program = await createTestProgram({ name: `mfst-x-${uid()}` })
+    programIds.push(program.id)
+    const { caller } = await newAdminCaller()
+    const u = await createTestUser('APPLICANT')
+    userIds.push(u.id)
+    const project = await createTestProject(program.id, {
+      title: `mfst-x-${uid()}`, competitionCategory: 'STARTUP',
+    })
+    const conf = await prisma.finalistConfirmation.create({
+      data: {
+        projectId: project.id, category: 'STARTUP', status: 'PENDING',
+        deadline: new Date(Date.now() + 86_400_000), token: `tok-${uid()}`,
+      },
+    })
+    await prisma.attendingMember.create({
+      data: { confirmationId: conf.id, userId: u.id },
+    })
+    await prisma.lunchEvent.create({ data: { programId: program.id, enabled: true } })
+    const manifest = await caller.getManifest({ programId: program.id })
+    expect(manifest.members).toHaveLength(0)
+  })
+})
+
+describe('lunch.exportManifestCsv', () => {
+  it('returns a CSV string with header + one row per attendee', async () => {
+    const program = await createTestProgram({ name: `csv-${uid()}` })
+    programIds.push(program.id)
+    const { caller } = await newAdminCaller()
+    const event = await prisma.lunchEvent.create({
+      data: { programId: program.id, enabled: true },
+    })
+    const dish = await prisma.dish.create({
+      data: { lunchEventId: event.id, name: 'Risotto', dietaryTags: [] },
+    })
+    await prisma.externalAttendee.create({
+      data: {
+        lunchEventId: event.id, name: 'X Y', dishId: dish.id, allergens: ['GLUTEN'],
+      },
+    })
+    const csv = await caller.exportManifestCsv({ programId: program.id })
+    expect(csv.split('\n')[0]).toBe('Type,Team,Name,Email,Dish,Allergens,Allergen notes')
+    expect(csv).toContain('External,,X Y,,Risotto,GLUTEN,')
+  })
+})
+
 describe('lunch.updateEvent', () => {
   it('patches an arbitrary subset of fields', async () => {
     const program = await createTestProgram({ name: `lunch-upd-${uid()}` })