Add NFC normalization to all FormData inputs across 41 server actions

All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.

src/actions/admin-bans.ts

@@ -15,7 +15,7 @@ export async function createBan(formData: FormData): Promise<void> {
   const staff = await requireStaff();
   const userId = Number(formData.get("userId"));
   const reason =
-    String(formData.get("reason") ?? "")
+    String(formData.get("reason") ?? "").normalize("NFC")
       .trim()
       .slice(0, 200) || "Banned";
   const hours = Number(formData.get("hours"));