fix(forms): unsichtbare Unicode-Zeichen in Eingaben strippen + FormCard-Rahmen

- cleanText(): Zero-Width-/Bidi-Marks/BOM (Copy-Paste aus iOS/WhatsApp)
  vor Validierung und im Payload entfernen — Telefonnummern mit
  U+202D/U+202C fielen sonst durch die Validierung
- FormCard.svelte: gerahmter Container, umschließt Kontakt- und
  Mitmachen-Formular

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/routes/api/mitmachen/+server.ts

@@ -3,6 +3,7 @@ import { env as publicEnv } from "$env/dynamic/public";
 import { env as privateEnv } from "$env/dynamic/private";
 import type { RequestHandler } from "./$types";
 import {
+  cleanText,
   HONEYPOT_FIELDS,
   LIMITS,
   validateFiles,
@@ -108,12 +109,14 @@ export const POST: RequestHandler = async ({ request, getClientAddress }) => {
     ? `${cmsBase}/api/forms/mitmachen/submit-multipart?_environment=${encodeURIComponent(cmsEnv)}`
     : `${cmsBase}/api/forms/mitmachen/submit-multipart`;
 
+  // cleanText: unsichtbare Format-Zeichen (Bidi-Marks aus Copy-Paste) raus —
+  // gleiche Normalisierung wie in der Validierung.
   const payload = {
-    title: fields.title.trim(),
-    description: fields.description.trim(),
-    contact_name: fields.contactName.trim(),
-    phone: fields.phone.trim(),
-    email: fields.email.trim(),
+    title: cleanText(fields.title),
+    description: cleanText(fields.description),
+    contact_name: cleanText(fields.contactName),
+    phone: cleanText(fields.phone),
+    email: cleanText(fields.email),
     consent_at: new Date().toISOString(),
     submitted_via: "windwiderstand.de/api/mitmachen",
     user_agent: (request.headers.get("user-agent") ?? "").slice(0, 200),