style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

Em dashes (—) and en dashes (–) had spread across comments, docs, tests,
and a few UI strings, reading as AI-generated boilerplate rather than
house style. Replaced each with punctuation matching its context: colon
for explanatory clauses, comma for asides, plain hyphen for numeric/legal
ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for
paired-dash asides. messages/en.json and messages/sv.json were fixed by
hand together to keep sv/en in sync.

Left untouched where the dash is the functional subject rather than
decorative punctuation: date-range-parser.ts's separator regex,
charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE
encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the
agent system-prompt files that already instruct against em dashes, and
a golden iXBRL test fixture compared byte-for-byte.

Also fixes two bugs surfaced along the way: an off-by-one in
ApiKeysPanel's scope-label split (a leftover from an earlier partial
pass), and a charset-repair test that had lost the literal en-dash it
exists to verify.

Regenerated the agent atom seed migration (skills:generate) since 27
SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes,
with an explicit carve-out for the functional-dash cases above.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

app/api/extensions/ext/[...path]/__tests__/route.test.ts

@@ -48,7 +48,7 @@ function createPathParams(path: string[]) {
 describe('Extension Catch-All Route', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    // clearAllMocks doesn't reset implementations — re-assert the default so the
+    // clearAllMocks doesn't reset implementations: re-assert the default so the
     // AAL2 test's mockReturnValue(true) can't leak into later cases.
     mockShouldEnforceMfa.mockReturnValue(false)
     extensionRegistry.clear()

app/api/extensions/ext/[...path]/route.ts

@@ -23,7 +23,7 @@ function generateRequestId(): string {
  *      `Felreferens: req_…`
  *
  * Non-JSON responses (HTML for OAuth callbacks, file downloads) only get the
- * header — body rewriting is reserved for the canonical envelope shape.
+ * header: body rewriting is reserved for the canonical envelope shape.
  */
 async function decorateResponse(response: Response, requestId: string): Promise<Response> {
   if (!response.headers.get('X-Request-Id')) {
@@ -54,7 +54,7 @@ async function decorateResponse(response: Response, requestId: string): Promise<
           })
         }
       } catch {
-        // Body wasn't valid JSON — leave it alone.
+        // Body wasn't valid JSON: leave it alone.
       }
     }
   }
@@ -69,13 +69,13 @@ export const maxDuration = 300
 
 /**
  * Per-extension runtime feature flags. Lets ops toggle an integration off
- * without redeploying or removing it from extensions.config.json — useful
+ * without redeploying or removing it from extensions.config.json: useful
  * for phased rollouts (dev tenants → design partners → general).
  *
  * The flag is checked on every request. If the env var is not exactly the
  * string "true", the dispatcher returns 503 with `code: 'EXTENSION_DISABLED'`.
  *
- * Server-side env vars only — no NEXT_PUBLIC_ prefix. Next.js inlines
+ * Server-side env vars only: no NEXT_PUBLIC_ prefix. Next.js inlines
  * NEXT_PUBLIC_* into the client bundle at build time, so a flip on Vercel
  * without a redeploy would create split-brain (server returns 503,
  * client still renders the enabled flow). UI panels detect the 503 by
@@ -197,7 +197,7 @@ async function handleRequest(
 
   // Config sanity check: these flags are orthogonal and the combination is
   // nonsensical. `skipAuth` already implies no company resolution, so adding
-  // `skipCompanyContext: true` is at best redundant — and if a maintainer
+  // `skipCompanyContext: true` is at best redundant, and if a maintainer
   // intended "auth required, no company" but also wrote `skipAuth: true`,
   // the auth requirement would be silently dropped (skipAuth fires first
   // below). Fail loudly instead of masking the mistake.
@@ -210,7 +210,7 @@ async function handleRequest(
   }
 
   // For skipAuth routes (e.g. OAuth callbacks from external providers),
-  // skip user auth, toggle check, and AI consent — dispatch immediately
+  // skip user auth, toggle check, and AI consent: dispatch immediately
   if (matchedRoute.skipAuth) {
     let handlerRequest = request
     if (Object.keys(extractedParams).length > 0) {
@@ -232,7 +232,7 @@ async function handleRequest(
     return decorateResponse(response, requestId)
   }
 
-  // Auth check — requireAuth() enforces MFA (AAL2) on hosted, which the previous
+  // Auth check: requireAuth() enforces MFA (AAL2) on hosted, which the previous
   // inline supabase.auth.getUser() did not. This dispatcher is the single
   // chokepoint for the entire enabled-extension surface (banking sync, document
   // upload/booking, supplier-invoice flows, migration), so enforcing MFA here
@@ -263,7 +263,7 @@ async function handleRequest(
 
   // Routes that are authenticated but run before a company exists (TIC
   // /lookup during onboarding, for example) opt out of company resolution.
-  // Dispatch without a context — handlers that opt in must not rely on ctx.
+  // Dispatch without a context: handlers that opt in must not rely on ctx.
   if (matchedRoute.skipCompanyContext) {
     const response = await matchedRoute.handler(handlerRequest)
     log.info('extension call completed', {