Add NFC normalization to all FormData inputs across 41 server actions

All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.

src/actions/admin-permissions.ts

@@ -14,17 +14,17 @@ import { logServerError } from "@/lib/server-log";
 // created_at/updated_at are managed here.
 
 function parseMinRank(formData: FormData): number {
-  const n = Number(String(formData.get("minRank") ?? "").trim());
+  const n = Number(String(formData.get("minRank") ?? "").normalize("NFC").trim());
   return Number.isInteger(n) && n >= 0 ? n : 1;
 }
 
 export async function createPermission(formData: FormData): Promise<void> {
   const staff = await requireStaff();
-  const permission = String(formData.get("permission") ?? "")
+  const permission = String(formData.get("permission") ?? "").normalize("NFC")
     .trim()
     .slice(0, 255);
   const minRank = parseMinRank(formData);
-  const description = String(formData.get("description") ?? "").trim() || null;
+  const description = String(formData.get("description") ?? "").normalize("NFC").trim() || null;
   if (!permission) return;
 
   const now = new Date();
@@ -51,14 +51,14 @@ export async function createPermission(formData: FormData): Promise<void> {
 
 export async function updatePermission(formData: FormData): Promise<void> {
   const staff = await requireStaff();
-  const raw = String(formData.get("id") ?? "");
+  const raw = String(formData.get("id") ?? "").normalize("NFC");
   if (!raw) return;
   const id = BigInt(raw);
-  const permission = String(formData.get("permission") ?? "")
+  const permission = String(formData.get("permission") ?? "").normalize("NFC")
     .trim()
     .slice(0, 255);
   const minRank = parseMinRank(formData);
-  const description = String(formData.get("description") ?? "").trim() || null;
+  const description = String(formData.get("description") ?? "").normalize("NFC").trim() || null;
   if (!permission) return;
 
   try {