Add NFC normalization to all FormData inputs across 41 server actions

All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.

src/actions/twofactor.ts

@@ -92,7 +92,7 @@ export async function confirmTwoFactor(formData: FormData): Promise<void> {
 
   if (!(await rateLimit(`2fa-confirm:${id}`, 5, 30_000)).ok) redirect("/settings/2fa?error=ratelimit");
 
-  const code = String(formData.get("code") ?? "").trim();
+  const code = String(formData.get("code") ?? "").normalize("NFC").trim();
 
   const { ok } = await verifyTwoFactorCode(id, code);
   if (!ok) redirect("/settings/2fa?error=badcode");
@@ -107,7 +107,7 @@ export async function disableTwoFactor(formData: FormData): Promise<void> {
 
   if (!(await rateLimit(`2fa-disable:${id}`, 5, 30_000)).ok) redirect("/settings/2fa?error=ratelimit");
 
-  const code = String(formData.get("code") ?? "").trim();
+  const code = String(formData.get("code") ?? "").normalize("NFC").trim();
 
   const { ok } = await verifyTwoFactorCode(id, code);
   if (!ok) redirect("/settings/2fa?error=badcode");