style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

Em dashes (—) and en dashes (–) had spread across comments, docs, tests,
and a few UI strings, reading as AI-generated boilerplate rather than
house style. Replaced each with punctuation matching its context: colon
for explanatory clauses, comma for asides, plain hyphen for numeric/legal
ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for
paired-dash asides. messages/en.json and messages/sv.json were fixed by
hand together to keep sv/en in sync.

Left untouched where the dash is the functional subject rather than
decorative punctuation: date-range-parser.ts's separator regex,
charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE
encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the
agent system-prompt files that already instruct against em dashes, and
a golden iXBRL test fixture compared byte-for-byte.

Also fixes two bugs surfaced along the way: an off-by-one in
ApiKeysPanel's scope-label split (a leftover from an earlier partial
pass), and a charset-repair test that had lost the literal en-dash it
exists to verify.

Regenerated the agent atom seed migration (skills:generate) since 27
SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes,
with an explicit carve-out for the functional-dash cases above.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

docker/Caddyfile

@@ -2,7 +2,7 @@
 	reverse_proxy app:3000
 
 	# HSTS: lock clients onto HTTPS for one year.
-	# `preload` is intentionally omitted — submission to browser preload lists
+	# `preload` is intentionally omitted: submission to browser preload lists
 	# is irreversible on short timescales (months of lead time to remove a
 	# domain). Operators who want preload eligibility can add the directive
 	# after committing to HTTPS-only permanently and submitting via

docker/cron.Dockerfile

@@ -6,11 +6,11 @@ ARG TARGETARCH
 # SHA-256 of the supercronic v0.2.33 release binaries.
 # Computed from https://github.com/aptible/supercronic/releases/download/v0.2.33/
 # (the upstream project publishes only SHA-1 checksums, so these are recorded here).
-# Dependabot watches FROM lines, not these ARGs — bump manually when SUPERCRONIC_VERSION changes.
+# Dependabot watches FROM lines, not these ARGs: bump manually when SUPERCRONIC_VERSION changes.
 ARG SUPERCRONIC_SHA256_AMD64=feefa310da569c81b99e1027b86b27b51e6ee9ab647747b49099645120cfc671
 ARG SUPERCRONIC_SHA256_ARM64=f1f8585c66de020fef494dd636058f99949d108f569fef00016a1c8b9eb145b3
 
-# curl stays in the image — the crontab uses it at runtime to call the app.
+# curl stays in the image: the crontab uses it at runtime to call the app.
 RUN apk add --no-cache curl \
     && case ${TARGETARCH} in \
          amd64) ARCH=linux-amd64; SHA=${SUPERCRONIC_SHA256_AMD64} ;; \