Add NFC normalization to all FormData inputs across 41 server actions

All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.

src/actions/radio-shouts.ts

@@ -28,7 +28,7 @@ export async function postShout(formData: FormData): Promise<void> {
   if (!(await rateLimit(`shout:${userId}`, 5, 30_000)).ok) return;
 
   const raw = {
-    message: String(formData.get("message") ?? "")
+    message: String(formData.get("message") ?? "").normalize("NFC")
       .trim()
       .slice(0, 255),
   };