style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

Em dashes (—) and en dashes (–) had spread across comments, docs, tests,
and a few UI strings, reading as AI-generated boilerplate rather than
house style. Replaced each with punctuation matching its context: colon
for explanatory clauses, comma for asides, plain hyphen for numeric/legal
ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for
paired-dash asides. messages/en.json and messages/sv.json were fixed by
hand together to keep sv/en in sync.

Left untouched where the dash is the functional subject rather than
decorative punctuation: date-range-parser.ts's separator regex,
charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE
encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the
agent system-prompt files that already instruct against em dashes, and
a golden iXBRL test fixture compared byte-for-byte.

Also fixes two bugs surfaced along the way: an off-by-one in
ApiKeysPanel's scope-label split (a leftover from an earlier partial
pass), and a charset-repair test that had lost the literal en-dash it
exists to verify.

Regenerated the agent atom seed migration (skills:generate) since 27
SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes,
with an explicit carve-out for the functional-dash cases above.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

app/api/settings/api-keys/[id]/route.ts

@@ -4,7 +4,7 @@ import { requireCompanyId } from '@/lib/company/context'
 import { requireWritePermission } from '@/lib/auth/require-write'
 
 /**
- * DELETE /api/settings/api-keys/[id] — Revoke an API key (soft delete)
+ * DELETE /api/settings/api-keys/[id]: Revoke an API key (soft delete)
  */
 export async function DELETE(
   _request: Request,

app/api/settings/api-keys/__tests__/route.test.ts

@@ -216,12 +216,12 @@ describe('POST /api/settings/api-keys', () => {
     )
     const { status, body } = await parseJsonResponse<{ data: { key: string } }>(res)
     expect(status).toBe(200)
-    // Real generateApiKey('test') runs — the returned secret carries the infix.
+    // Real generateApiKey('test') runs: the returned secret carries the infix.
     expect(body.data.key).toMatch(/^gnubok_sk_test_/)
 
     const payload = insertSpy.mock.calls[0][0] as Record<string, unknown>
     expect(payload.mode).toBe('test')
-    // Test keys are simulation-only — they bind to the active company (the v1
+    // Test keys are simulation-only: they bind to the active company (the v1
     // wrapper forces dry-run so they never persist).
     expect(payload.company_id).toBe('company-1')
   })

app/api/settings/api-keys/route.ts

@@ -9,14 +9,14 @@ import { withRouteContext } from '@/lib/api/with-route-context'
 import { errorResponse, errorResponseFromCode } from '@/lib/errors/get-structured-error'
 import type { ApiKeyMode, ApiKeyScope } from '@/lib/auth/api-keys'
 
-/** GET /api/settings/api-keys — list the company's API keys (key value never returned). */
+/** GET /api/settings/api-keys: list the company's API keys (key value never returned). */
 export const GET = withRouteContext(
   'api_key.list',
   async (_request, ctx) => {
     const { supabase, companyId, log, requestId } = ctx
 
     // Both live and test keys for the active company. (Test keys are bound to the
-    // active company too — they're simulation-only, so they never write real data.)
+    // active company too: they're simulation-only, so they never write real data.)
     const { data, error } = await supabase
       .from('api_keys')
       .select('id, key_prefix, name, scopes, mode, rate_limit_rpm, last_used_at, revoked_at, created_at')
@@ -33,7 +33,7 @@ export const GET = withRouteContext(
 )
 
 /**
- * POST /api/settings/api-keys — create a new API key.
+ * POST /api/settings/api-keys: create a new API key.
  *
  * Returns the full key exactly once; after this the prefix is the only
  * stored representation.
@@ -64,11 +64,11 @@ export const POST = withRouteContext(
         })
       }
     } catch {
-      // Empty body — use defaults.
+      // Empty body: use defaults.
     }
 
     // Both live and test keys bind to the active company. A test key is
-    // simulation-only — the v1 wrapper forces dry-run on every write — so it can
+    // simulation-only (the v1 wrapper forces dry-run on every write) so it can
     // safely point at the real company without ever persisting anything.
 
     // Segregation of duties: warn + require explicit acknowledgement (not block)