Add NFC normalization to all FormData inputs across 41 server actions

All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.

src/actions/draw-badge.ts

@@ -50,7 +50,7 @@ export async function buyBadge(formData: FormData): Promise<void> {
 
   // The form posts the badge row id; everything else (price, code) is resolved
   // server-side from trusted data — never from the client.
-  const rawId = String(formData.get("id") ?? "").trim();
+  const rawId = String(formData.get("id") ?? "").normalize("NFC").trim();
   if (!/^\d+$/.test(rawId)) redirect("/draw-badge?error=invalid");
 
   let outcome: "bought" | "invalid" | "credits" | "fail";