style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

Em dashes (—) and en dashes (–) had spread across comments, docs, tests,
and a few UI strings, reading as AI-generated boilerplate rather than
house style. Replaced each with punctuation matching its context: colon
for explanatory clauses, comma for asides, plain hyphen for numeric/legal
ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for
paired-dash asides. messages/en.json and messages/sv.json were fixed by
hand together to keep sv/en in sync.

Left untouched where the dash is the functional subject rather than
decorative punctuation: date-range-parser.ts's separator regex,
charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE
encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the
agent system-prompt files that already instruct against em dashes, and
a golden iXBRL test fixture compared byte-for-byte.

Also fixes two bugs surfaced along the way: an off-by-one in
ApiKeysPanel's scope-label split (a leftover from an earlier partial
pass), and a charset-repair test that had lost the literal en-dash it
exists to verify.

Regenerated the agent atom seed migration (skills:generate) since 27
SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes,
with an explicit carve-out for the functional-dash cases above.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

lib/api/idempotency.ts

@@ -3,7 +3,7 @@
  *
  * Use case: an agent (MCP, automation webhook, scripted client) retries an
  * operation after a network blip. Without idempotency, the retry creates a
- * duplicate side-effect — two invoices, two journal entries, two emails.
+ * duplicate side-effect: two invoices, two journal entries, two emails.
  *
  * Contract:
  *   1. The caller supplies an `idempotency_key` per logical operation.
@@ -18,7 +18,7 @@
  * the wrong company can never receive the other company's cached response.
  *
  * 24-hour TTL is enforced by an `expires_at` column + a cleanup cron. After
- * 24h, the same key may be reused safely — agents that retry that long after
+ * 24h, the same key may be reused safely: agents that retry that long after
  * the original request are not retrying, they're starting over.
  */
 import crypto from 'crypto'
@@ -64,7 +64,7 @@ function canonicalJson(value: unknown): string {
  *     without side-effects)
  *
  * Throws IdempotencyKeyReuseError when the key exists with a *different*
- * request hash — the caller is misusing the key.
+ * request hash: the caller is misusing the key.
  */
 export async function checkIdempotencyKey(
   supabase: SupabaseClient,
@@ -125,7 +125,7 @@ export async function storeIdempotencyResponse(
       response_body: body,
     })
 
-  // Postgres 23505 is unique_violation — a concurrent retry already inserted.
+  // Postgres 23505 is unique_violation: a concurrent retry already inserted.
   // Silently OK; the cached response from the winner will be returned to
   // both callers on subsequent reads.
   if (error && error.code !== '23505') {