feat(my-programs): roster, attendance summary, stats + CSV for program leads

[jee7s]

What / why

Program leads have a home (/my-programs) with an attendance inbox and a
conflicts tab, but still can't answer everyday operational questions in-app:
who's in my program, how do I reach their family, who's been showing up, and how
full am I? This adds the read-only Roster surface the scoping doc's "Next"
section called for.

Design: checkin-app/docs/designs/MY_PROGRAMS_INFO.md (builds on the repo-root
docs/designs/MY_PROGRAMS_SCOPING.md).

Decisions (from the product interview — for programs the caller LEADS)

1. Roster + contact — participant list with status + the household-lead
   email/phone ("who do I call").
2. Attendance summary — per-participant attendance count/last-seen +
   per-session turnout, co-located with the roster.
3. CSV export — roster and per-session turnout, same scoped route (?format=csv).
4. Stats card — enrollment vs capacity, session count, and a scholarship-request
   COUNT ONLY (no names — finance-confidential).

Implementation

• One new scoped route GET /api/my-programs/[id] (withAuth, tight selects,
  like nav/todo-counts): returns { program, roster, events } or a text/csv
  attachment. Data only when the caller leads the program (leadMentorId) or
  is board/sysadmin; else 403.
• New /my-programs/roster subtab (stats card, roster table with contact +
  attendance, turnout table, CSV buttons). Reuses the layout's lead-gate.
• Pure math + CSV serialization in src/lib/programRoster.ts (unit-tested, no DB).
• No schema change, no security-boundary change — no src/security/** edit,
  ships as one self-contained PR.

PII discipline

• Scoping (query-shaping by leadMentorId) is the control — added to
  EDGE_INCLUDE_ALLOWLIST in tests/security/routeAuthDrift.test.ts (rule 3).
• Finance-confidential fields (isPaymentPlanRequested / paymentPlanDeniedAt /
  inventoryHeldAt / pendingSince) are never selected onto a row; scholarship is
  a bare count. Asserted by an integration test grepping the JSON/CSV.
• Household-lead email/phone are the contact-identity band leads may already
  hold; not new PII.

Testing evidence

• Unit (programRoster.test.ts, node): visit aggregation (distinct events/people,
  last-seen), CSV RFC-4180 escaping, roster/events CSV shape — 8 tests.
• RTL (roster/__tests__/page.test.tsx): renders stats + contact + turnout + CSV links.
• Integration (myProgramsInfoAPI.integration.test.ts, shared DB): lead sees own,
  403 for others, board override, 404/401, PII shape, roster + events CSV content — 7 tests.
• npx tsc --noEmit clean; eslint --max-warnings 0 clean on all touched files.

🤖 Generated with Claude Code