Add NFC normalization to all FormData inputs across 41 server actions

All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.

src/actions/user-settings.ts

@@ -34,7 +34,7 @@ const updateMottoAction = authAction(
 );
 
 export async function updateMotto(formData: FormData): Promise<void> {
-  const motto = String(formData.get("motto") ?? "").slice(0, MOTTO_MAX);
+  const motto = String(formData.get("motto") ?? "").normalize("NFC").slice(0, MOTTO_MAX);
   await updateMottoAction({ motto });
 }