Add NFC normalization to all FormData inputs across 41 server actions

All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.

src/actions/admin-vouchers.ts

@@ -9,7 +9,7 @@ import { logServerError } from "@/lib/server-log";
 export async function createVoucher(formData: FormData): Promise<void> {
   await requireStaff();
 
-  const code = String(formData.get("code") ?? "")
+  const code = String(formData.get("code") ?? "").normalize("NFC")
     .trim()
     .slice(0, 255);
   const amount = Number(formData.get("amount"));
@@ -18,7 +18,7 @@ export async function createVoucher(formData: FormData): Promise<void> {
 
   if (!code || !(amount > 0)) return;
 
-  const expiresRaw = String(formData.get("expiresAt") ?? "").trim();
+  const expiresRaw = String(formData.get("expiresAt") ?? "").normalize("NFC").trim();
   let expiresAt: Date | null = null;
   if (expiresRaw) {
     const parsed = new Date(expiresRaw);