Add NFC normalization to all FormData inputs across 41 server actions

All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.

src/actions/auth-precheck.ts

@@ -12,7 +12,7 @@ export type PrecheckResult = "ok" | "invalid" | "twofactor";
  * TOTP code is still required. Lets the login form do the two-step 2FA flow.
  */
 export async function precheckLogin(username: string, password: string): Promise<PrecheckResult> {
-  const u = String(username ?? "").trim();
+  const u = String(username ?? "").normalize("NFC").trim();
   const p = String(password ?? "");
   if (!u || !p) return "invalid";