"Same address, different bytes": normalizing emails with NFKC before you rate-limit them

Rate limits, duplicate checks and blocklists all assume the same email is the same string. Full-width Unicode breaks that assumption, and we found out from a bounced verification email: 422 Invalid `t