chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

server/cmd/main.go

@@ -39,7 +39,7 @@ import (
 // comment group, separated by a real blank line rather than a bare "//": Go's
 // parser only splits ast.CommentGroups on an actual blank line, and
 // swag v2.0.0-rc5's parseSecAttributesV3 resolves a scheme's map key by
-// scanning from the start of whatever comment group it was handed — so three
+// scanning from the start of whatever comment group it was handed - so three
 // stacked blocks sharing one group all collapse onto the first block's name.
 // Three groups means three independent scans, each finding its own name.
 
@@ -63,7 +63,7 @@ func main() {
 	//
 	// Under Docker Compose neither is set and nothing changes: one process
 	// migrates and then serves. Under Kubernetes with more than one replica
-	// that is unsafe — every pod would run MigrateOrgToInstance at once, and
+	// that is unsafe - every pod would run MigrateOrgToInstance at once, and
 	// renaming collections while a sibling reads them is not a race anyone
 	// wins. The chart therefore runs a pre-upgrade Job with MIGRATE_ONLY and
 	// starts the Deployment with SKIP_MIGRATIONS.
@@ -198,7 +198,7 @@ func runSchemaSetup() {
 }
 
 // apiVersion mirrors the @version annotation on the swagger block above,
-// which is the only version string this server already establishes — there is
+// which is the only version string this server already establishes - there is
 // no separate runtime build-version constant to reuse instead. Nothing ties
 // the two together mechanically, so change them in the same commit: this is
 // the value mcp.SetVersion reports to MCP clients, and it must keep agreeing
@@ -225,8 +225,8 @@ func serve() {
 	}
 	log.Printf("message bus ready as node %s", bus.NodeID())
 
-	// Cancelled on SIGTERM/SIGINT. Everything below that takes a context — the
-	// housekeeping jobs, the leader lock — stops when the pod is asked to.
+	// Cancelled on SIGTERM/SIGINT. Everything below that takes a context - the
+	// housekeeping jobs, the leader lock - stops when the pod is asked to.
 	ctx, shutdown := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
 	defer shutdown()
 
@@ -241,7 +241,7 @@ func serve() {
 	// every monitor check firing N times, every incident notification delivered
 	// to the customer N times, every retention sweep deleting concurrently, and
 	// N reapers racing to purge the same instance. They share one lock rather
-	// than holding four, because they are one role — housekeeping — and
+	// than holding four, because they are one role - housekeeping - and
 	// splitting them would only spread that role across pods for no benefit.
 	bus.RunAsLeader(ctx, "housekeeping", func(jobCtx context.Context) {
 		services.StartLogSweeper(jobCtx)
@@ -278,7 +278,7 @@ func serve() {
 	// caller wrote in X-Forwarded-For. That was survivable while ClientIP()
 	// only produced audit strings; the public status limiter makes it load
 	// bearing. Empty means trust nobody, which is correct for a direct
-	// exposure and wrong behind a proxy — hence the explicit setting.
+	// exposure and wrong behind a proxy - hence the explicit setting.
 	if err := r.SetTrustedProxies(api.TrustedProxies()); err != nil {
 		log.Fatalf("trusted proxies: %v", err)
 	}
@@ -365,7 +365,7 @@ func boolEnv(key string) bool {
 // It replaces a substring filter that fed in only routes whose path contained
 // "server", ":serverId", "console" or "assign". That filter could only ever
 // catch a route whose *path* named a server, and a route can act on one named
-// in its body, in a query parameter, or derived by the handler — it caught one
+// in its body, in a query parameter, or derived by the handler - it caught one
 // of the leaks found in the final review of the MCP feature, and none of the
 // eleven found during implementation. Declaring every route is more typing
 // once and no maintenance after: a new route fails boot until somebody answers