Add NFC normalization to all FormData inputs across 41 server actions

All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.

src/actions/admin-housekeeping.ts

@@ -11,11 +11,11 @@ import { prisma } from "@/lib/prisma";
 export async function upsertPermission(formData: FormData): Promise<void> {
   await requireStaff();
 
-  const permission = String(formData.get("permission") ?? "")
+  const permission = String(formData.get("permission") ?? "").normalize("NFC")
     .trim()
     .slice(0, 255);
   const minRank = Number(formData.get("minRank"));
-  const descriptionRaw = String(formData.get("description") ?? "")
+  const descriptionRaw = String(formData.get("description") ?? "").normalize("NFC")
     .trim()
     .slice(0, 255);
   const description = descriptionRaw.length > 0 ? descriptionRaw : null;
@@ -38,7 +38,7 @@ export async function upsertPermission(formData: FormData): Promise<void> {
 export async function deletePermission(formData: FormData): Promise<void> {
   await requireStaff();
 
-  const raw = String(formData.get("id") ?? "");
+  const raw = String(formData.get("id") ?? "").normalize("NFC");
   if (!raw) return;
 
   try {