Add NFC normalization to all FormData inputs across 41 server actions

All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.

src/actions/admin-users.ts

@@ -30,7 +30,7 @@ export async function giveCurrency(formData: FormData): Promise<void> {
 export async function setMotto(formData: FormData): Promise<void> {
   await requireStaff();
   const userId = Number(formData.get("userId"));
-  const motto = String(formData.get("motto") ?? "").slice(0, 127);
+  const motto = String(formData.get("motto") ?? "").normalize("NFC").slice(0, 127);
   if (userId > 0) {
     await prisma.user.update({ where: { id: userId }, data: { motto } });
     await rcon.setMotto(userId, motto);
@@ -59,13 +59,13 @@ export async function setRank(formData: FormData): Promise<void> {
 export async function alertUser(formData: FormData): Promise<void> {
   await requireStaff();
   const userId = Number(formData.get("userId"));
-  const message = String(formData.get("message") ?? "").trim();
+  const message = String(formData.get("message") ?? "").normalize("NFC").trim();
   if (userId > 0 && message) await rcon.alertUser(userId, message);
 }
 
 export async function disconnectUser(formData: FormData): Promise<void> {
   await requireStaff();
   const userId = Number(formData.get("userId"));
-  const username = String(formData.get("username") ?? "");
+  const username = String(formData.get("username") ?? "").normalize("NFC");
   if (userId > 0) await rcon.disconnectUser(userId, username);
 }