chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

server/internal/auth/github.go

@@ -44,7 +44,7 @@ func githubOAuthConfig(p *models.AuthProvider, secret, redirectURL string) *oaut
 //
 // Verified alone is not enough: a non-primary address is one the person happens
 // to have proved, not the one they present as themselves. Primary alone is far
-// worse — an unverified address is not proof of control at all, and accepting
+// worse - an unverified address is not proof of control at all, and accepting
 // one would let anyone with a GitHub account claim any address in the instance.
 func selectGitHubEmail(emails []githubEmail) (string, error) {
 	for _, e := range emails {

server/internal/auth/instancehost.go

@@ -61,8 +61,8 @@ func hostSlug(host string) string {
 func HostSlug(host string) string { return hostSlug(host) }
 
 // InstanceFromHost resolves the instance named by the request's own Host
-// header. Callers that must resolve a host from somewhere else — the public
-// status page reads a trusted X-Forwarded-Host — use InstanceForHost so the
+// header. Callers that must resolve a host from somewhere else - the public
+// status page reads a trusted X-Forwarded-Host - use InstanceForHost so the
 // slug rules and the 60s cache stay single-implementation.
 func InstanceFromHost(c *gin.Context) (*models.Instance, bool) {
 	return InstanceForHost(c.Request.Host)
@@ -82,7 +82,7 @@ func InstanceForHost(host string) (*models.Instance, bool) {
 	if err != nil || inst == nil {
 		// Negative entries are cached too. Without them an unknown but
 		// well-formed host costs a Mongo query per anonymous request, which
-		// the public status page exposes to the open internet — and the
+		// the public status page exposes to the open internet - and the
 		// round trip is itself a timing oracle separating "no such instance"
 		// from "instance exists, page does not".
 		storeInstance(slug, nil)
@@ -93,7 +93,7 @@ func InstanceForHost(host string) (*models.Instance, bool) {
 }
 
 // SoleInstance resolves the one instance of a deployment that has exactly one.
-// It is how a self-hosted install serves a host that names no slug at all —
+// It is how a self-hosted install serves a host that names no slug at all -
 // vantage.acme.com, status.acme.com, or a bare address. It reuses the same
 // count-then-read that bootstrap uses, and refuses rather than guessing when
 // more than one instance exists.

server/internal/auth/local.go

@@ -89,7 +89,7 @@ func HandleLocalLogin(c *gin.Context) {
 }
 
 // HandleListPublicProviders is unauthenticated: it is what the login page reads
-// to decide what to draw. It carries no issuer, no client ID and no secret —
+// to decide what to draw. It carries no issuer, no client ID and no secret -
 // only what a button needs, because anyone who can reach the login page can
 // read this.
 func HandleListPublicProviders(c *gin.Context) {

server/internal/auth/middleware.go

@@ -104,7 +104,7 @@ func sessionFromCookie(c *gin.Context) (*Session, bool) {
 	}
 	sess, err := GetSession(c.Request.Context(), cookie.Value)
 	if err != nil {
-		// A stale cookie plus a valid bearer token is a real combination —
+		// A stale cookie plus a valid bearer token is a real combination -
 		// a browser tab left open beside a curl. Fall through rather than
 		// refusing a credential that would have worked.
 		if bearerToken(c) != "" {
@@ -203,7 +203,7 @@ func IsToken(c *gin.Context) bool { return TokenID(c) != "" }
 
 // ServerScope is the tag restriction the acting credential carries, or nil for
 // an unrestricted token and for every cookie session. Callers pass it to
-// services.ServerInTokenScope or services.IntersectSelectors — nil means the
+// services.ServerInTokenScope or services.IntersectSelectors - nil means the
 // whole fleet, never nothing.
 func ServerScope(c *gin.Context) map[string]string {
 	if s := GetSessionFromContext(c); s != nil {

server/internal/auth/presets.go

@@ -44,7 +44,7 @@ var presets = []Preset{
 		Kind:         models.KindOIDC,
 		IssuerFormat: "https://%s/oauth2/default",
 		InputLabel:   "Okta org domain",
-		InputHint:    "e.g. acme.okta.com — no scheme, no trailing slash.",
+		InputHint:    "e.g. acme.okta.com - no scheme, no trailing slash.",
 		Scopes:       []string{"openid", "profile", "email"},
 	},
 	{

server/internal/auth/session.go

@@ -24,7 +24,7 @@ type Session struct {
 	Name       string `json:"name"`
 
 	// The four fields below are set only when the request authenticated with
-	// an API token. They are never persisted to Redis — a token authenticates
+	// an API token. They are never persisted to Redis - a token authenticates
 	// per request and mints no session, so a revoked token stops working
 	// immediately rather than at the end of a session TTL.
 	TokenID    string            `json:"-"`
@@ -38,7 +38,7 @@ var rdb *redis.Client
 // InitRedis connects the session store.
 //
 // Username and password may both be empty for an unauthenticated instance. For
-// a legacy `requirepass` Redis, pass the password with an empty username —
+// a legacy `requirepass` Redis, pass the password with an empty username -
 // go-redis then sends AUTH with one argument instead of two.
 func InitRedis(addr, username, password string) error {
 	rdb = redis.NewClient(&redis.Options{