chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

web/components/apikeys/ApiKeysPanel.tsx

@@ -34,7 +34,7 @@ function rolesAtOrBelow(role: Role): Role[] {
  * The whole API Keys page body, header included.
  *
  * It is a page rather than a card on /settings because any member may mint and
- * revoke their own keys — the API has never required owner or admin for that —
+ * revoke their own keys - the API has never required owner or admin for that -
  * while /settings is owner|admin throughout. The instance-wide lifetime cap
  * stays on /settings, being policy rather than one person's credentials.
  */
@@ -138,7 +138,7 @@ export function ApiKeysPanel() {
 
     function closeCreate() {
         // The plaintext is gone once this closes, so only invalidate having
-        // shown it — closing before a result exists is a plain cancel.
+        // shown it - closing before a result exists is a plain cancel.
         if (result) invalidate();
         setCreateOpen(false);
         resetCreateError();
@@ -169,7 +169,7 @@ export function ApiKeysPanel() {
             </div>
 
             {/* Owner and admin can see everyone's keys, so the scope of the list
-                is a filter rather than a preference — the same pill treatment
+                is a filter rather than a preference - the same pill treatment
                 the vulnerabilities page uses for its state filter, so a person
                 who has learned one has learned both. */}
             {isAdmin && (

web/components/apikeys/CreateKeyDialog.tsx

@@ -131,7 +131,7 @@ export function CreateKeyDialog({
             {result ? (
                 <div className="space-y-4">
                     <div className="rounded border border-warning/30 bg-warning/10 px-3 py-2 text-sm text-warning">
-                        This is the only time the key is shown. Copy it now — Vantage stores only a hash and cannot show it again.
+                        This is the only time the key is shown. Copy it now - Vantage stores only a hash and cannot show it again.
                     </div>
 
                     {/* Below sm the button drops beneath the value: Copy has to
@@ -198,7 +198,7 @@ export function CreateKeyDialog({
                     className="space-y-5"
                 >
                     <div className="grid gap-4 sm:grid-cols-2">
-                        <Field label="Name" hint="What will use this key — the CI pipeline, the script, the cluster.">
+                        <Field label="Name" hint="What will use this key - the CI pipeline, the script, the cluster.">
                             <input required value={name} onChange={(e) => setName(e.target.value)} className={inputClass} />
                         </Field>
 
@@ -238,7 +238,7 @@ export function CreateKeyDialog({
                                 const disabled = capDays > 0 && (o.days === null || o.days > capDays);
                                 return (
                                     <option key={o.label} value={o.days === null ? "never" : String(o.days)} disabled={disabled}>
-                                        {o.days === null ? o.label : `${o.label} — ${expiryDate(o.days)}`}
+                                        {o.days === null ? o.label : `${o.label} - ${expiryDate(o.days)}`}
                                     </option>
                                 );
                             })}

web/components/apikeys/KeyLedger.tsx

@@ -12,7 +12,7 @@ export function roleVariant(role: Role) {
 
 /*
  * A grid rather than the shared <Table>: the identity column stacks four
- * things — name, hint, holder, role — and Td assumes one value per cell.
+ * things - name, hint, holder, role - and Td assumes one value per cell.
  *
  * Below lg the grid collapses to a stacked record and each cell grows its own
  * label from data-label. A date sitting under a chip list with no headings is

web/components/apikeys/KeyPosture.tsx

@@ -3,7 +3,7 @@ import { keyLifetime } from "@/lib/keyLifetime";
 
 /*
  * Four counts above the list, answering "is anything wrong here" before a
- * single row is read. All four are derived from the tokens already in hand —
+ * single row is read. All four are derived from the tokens already in hand -
  * no second request, and no endpoint that could disagree with the list.
  *
  * The counts describe the list as filtered, so this sits below the My keys /

web/components/apikeys/LifetimeBar.tsx

@@ -35,7 +35,7 @@ export function LifetimeBar({ token, capDays }: { token: ApiToken; capDays: numb
                 <div className={`h-full ${FILL[state]}`} style={{ width: `${remainingPct}%` }} />
             </div>
             <span className={`font-mono text-xs tabular-nums ${TEXT[state]}`}>{label}</span>
-            {outsidePolicy && <p className="text-xs text-warning">Outside the current policy — rotate when convenient.</p>}
+            {outsidePolicy && <p className="text-xs text-warning">Outside the current policy - rotate when convenient.</p>}
         </div>
     );
 }

web/components/apikeys/ScopeChips.tsx

@@ -22,7 +22,7 @@ export function summariseScopes(scopes: string[]): { resource: string; access: s
 }
 
 /**
- * The chip splits in two — resource, then a tinted access half — so the read
+ * The chip splits in two - resource, then a tinted access half - so the read
  * and write halves of a grant are told apart without reading either word.
  *
  * `wrap` is false in the ledger, where the list scrolls in its own track on a

web/components/apikeys/ScopeMatrix.tsx

@@ -4,7 +4,7 @@
  * Nine bordered cards each holding two checkboxes made the grant look like nine
  * decisions. It is one decision with a shape, and a matrix is the shape.
  *
- * Resources come from GET /api/tokens/scopes and are never hardcoded here —
+ * Resources come from GET /api/tokens/scopes and are never hardcoded here -
  * the endpoint is the source of truth and the vocabulary grows.
  */
 

web/components/apikeys/TagRestriction.tsx

@@ -91,7 +91,7 @@ export function TagRestriction({
 }
 
 /** The same restriction rendered for a key that already exists. Unrestricted
- *  renders nothing at all — most keys are, and a chip on every row for the
+ *  renders nothing at all - most keys are, and a chip on every row for the
  *  common case is noise rather than information. */
 export function TagChips({ selector }: { selector?: Record<string, string> | null }) {
     const pairs = Object.entries(selector ?? {});