Add NFC normalization to all FormData inputs across 41 server actions

All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.

src/actions/admin-badge-upload.ts

@@ -27,7 +27,7 @@ export async function uploadBadge(formData: FormData): Promise<void> {
     back("error", "Badge upload directory not configured");
   }
 
-  const code = String(formData.get("code") ?? "").trim();
+  const code = String(formData.get("code") ?? "").normalize("NFC").trim();
   if (!CODE_RE.test(code)) {
     back("error", "Invalid badge code (use A-Z, 0-9, _ or -, max 64 chars)");
   }