Add NFC normalization to all FormData inputs across 41 server actions

All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.

src/actions/admin-ads.ts

@@ -12,7 +12,7 @@ import { formPositiveBigInt } from "@/lib/form-data";
 
 export async function createAd(formData: FormData): Promise<void> {
   const staff = await requireStaff();
-  const image = String(formData.get("image") ?? "")
+  const image = String(formData.get("image") ?? "").normalize("NFC")
     .trim()
     .slice(0, 255);
   if (!image) return;
@@ -39,10 +39,10 @@ export async function createAd(formData: FormData): Promise<void> {
 
 export async function updateAd(formData: FormData): Promise<void> {
   const staff = await requireStaff();
-  const raw = String(formData.get("id") ?? "");
+  const raw = String(formData.get("id") ?? "").normalize("NFC");
   if (!/^\d+$/.test(raw)) return;
   const id = BigInt(raw);
-  const image = String(formData.get("image") ?? "")
+  const image = String(formData.get("image") ?? "").normalize("NFC")
     .trim()
     .slice(0, 255);
   if (!image) return;