Add NFC normalization to all FormData inputs across 41 server actions

All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.

src/actions/article-reactions.ts

@@ -31,12 +31,12 @@ export async function toggleReaction(formData: FormData): Promise<void> {
   const userId = Number(session.user.id);
   if (!Number.isFinite(userId)) return;
 
-  const reaction = String(formData.get("reaction") ?? "")
+  const reaction = String(formData.get("reaction") ?? "").normalize("NFC")
     .trim()
     .toLowerCase();
   if (!ALLOWED_REACTIONS.has(reaction)) return;
 
-  const articleIdRaw = String(formData.get("articleId") ?? "").trim();
+  const articleIdRaw = String(formData.get("articleId") ?? "").normalize("NFC").trim();
   if (!/^\d+$/.test(articleIdRaw)) return;
 
   let articleId: bigint;