style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

Em dashes (—) and en dashes (–) had spread across comments, docs, tests,
and a few UI strings, reading as AI-generated boilerplate rather than
house style. Replaced each with punctuation matching its context: colon
for explanatory clauses, comma for asides, plain hyphen for numeric/legal
ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for
paired-dash asides. messages/en.json and messages/sv.json were fixed by
hand together to keep sv/en in sync.

Left untouched where the dash is the functional subject rather than
decorative punctuation: date-range-parser.ts's separator regex,
charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE
encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the
agent system-prompt files that already instruct against em dashes, and
a golden iXBRL test fixture compared byte-for-byte.

Also fixes two bugs surfaced along the way: an off-by-one in
ApiKeysPanel's scope-label split (a leftover from an earlier partial
pass), and a charset-repair test that had lost the literal en-dash it
exists to verify.

Regenerated the agent atom seed migration (skills:generate) since 27
SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes,
with an explicit carve-out for the functional-dash cases above.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

app/api/extensions/enable-banking/callback/route.ts

@@ -8,7 +8,7 @@ import { upsertFromPsd2 } from '@/lib/cash-accounts/service'
 
 // This route emits bank_connection.consent_granted / .cash_account_mirror_failed
 // (ASVS V16 / GDPR Art.30 audit events). ensureInitialized() must run at module
-// load so registerEventLogHandler() has subscribed before the first emit() —
+// load so registerEventLogHandler() has subscribed before the first emit();
 // otherwise the audit row is silently dropped on a cold instance where this
 // redirect route is the first event-emitting code path to execute.
 ensureInitialized()
@@ -163,7 +163,7 @@ export async function GET(request: Request) {
 
     // GDPR Art.5(1)(c) / Art.25(1): data minimization. We only store the
     // metadata the user needs to pick which accounts to sync (uid, name, IBAN,
-    // currency). Balances are bank account financial data — we don't fetch
+    // currency). Balances are bank account financial data: we don't fetch
     // them here. The first sync (after the user enables specific accounts)
     // populates balance + balance_updated_at via lib/sync.ts. Accounts the
     // user deselects never have their balance pulled.
@@ -231,7 +231,7 @@ export async function GET(request: Request) {
         })
         // Persist the failure to event_log so a security review can see that
         // a PSD2 account returned by the bank was not mirrored into our
-        // routing table — otherwise this is only visible in console output
+        // routing table; otherwise this is only visible in console output
         // (ASVS V16 / ISO 27001 A.8.15 / SOC 2 CC7.2).
         try {
           await eventBus.emit({