Add NFC normalization to all FormData inputs across 41 server actions

All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.

src/actions/admin-badges.ts

@@ -9,7 +9,7 @@ export async function giveBadge(formData: FormData): Promise<void> {
   await requireStaff();
 
   const userId = Number(formData.get("userId"));
-  const code = String(formData.get("code") ?? "")
+  const code = String(formData.get("code") ?? "").normalize("NFC")
     .trim()
     .slice(0, 32);
   if (!(userId > 0) || code.length === 0) return;