chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

web/lib/api.ts

@@ -180,7 +180,7 @@ export type ChannelType = "webhook" | "smtp" | "discord" | "slack" | "telegram";
  * written verbatim.
  *
  * Mirrors `models.RedactedSecret` and `models.channelSecretKeys` in
- * `server/internal/models/channel.go` — change both in the same commit, the
+ * `server/internal/models/channel.go` - change both in the same commit, the
  * same hazard as the mirrored token blocks.
  */
 export const REDACTED_SECRET = "••••••••";
@@ -304,7 +304,7 @@ export type ApiToken = {
     user_id: string;
     user_email?: string;
     /** Restricts the token to servers carrying every pair. Absent or empty is
-     *  the whole fleet — the asymmetry is deliberate, see services.MatchesSelector. */
+     *  the whole fleet - the asymmetry is deliberate, see services.MatchesSelector. */
     tag_selector?: Record<string, string> | null;
 };
 
@@ -1147,7 +1147,7 @@ export interface VulnFinding {
     cve_id: string;
     package_name: string;
     installed_version: string;
-    /** Absent means no vendor fix is published — a real state, not missing data. */
+    /** Absent means no vendor fix is published - a real state, not missing data. */
     fixed_in?: string;
     severity: Severity;
     cvss_score?: number;
@@ -1385,7 +1385,7 @@ export interface Skip {
 // Public status page types
 //
 // These mirror services.StatusSnapshot and friends in
-// server/internal/services/statussnapshot.go field for field — that Go file
+// server/internal/services/statussnapshot.go field for field - that Go file
 // is the contract. They back the anonymous /status/[pageId] page, which is
 // deliberately outside the (app) route group and never calls `request()`
 // (no session, no auth). Task 10 adds the authoring types and api client

web/lib/auditEvents.ts

@@ -4,7 +4,7 @@
  * The page used to hold a map of eleven event types to labels and a second map
  * of seven to colours. The server emits forty-seven. Everything unmapped fell
  * through to the raw string, so one row read "Key Assigned" in green and the
- * next "workflow.schedule_updated" in grey — the same kind of fact in two
+ * next "workflow.schedule_updated" in grey - the same kind of fact in two
  * different formats, which made the column look like it carried a meaning it
  * did not.
  *
@@ -50,7 +50,7 @@ const CATEGORY_LABELS = new Map(AUDIT_CATEGORIES.map((c) => [c.value, c.label]))
  * deleting a workflow are the same weight of act.
  *
  * Stems match with or without their past tense, because the two spellings both
- * occur — `auth_provider.delete` beside `key.deleted`, `workload.stop` beside
+ * occur - `auth_provider.delete` beside `key.deleted`, `workload.stop` beside
  * `workflow.schedule_disabled`. Matching only the past tense left half the
  * destructive events drawn in the same grey as a settings change.
  *
@@ -69,7 +69,7 @@ const TONE_RULES: [RegExp, AuditTone][] = [
 
 /*
  * Only where the derived text is wrong or reads clumsily. Anything absent is
- * derived, which is the point — this list should stay short.
+ * derived, which is the point - this list should stay short.
  */
 const OVERRIDES: Record<string, string> = {
     "key.generation_dispatched": "Key generation requested",

web/lib/guacConsole.ts

@@ -48,7 +48,7 @@ const STATUS_TEXT: Record<number, string> = {
   522: "The session timed out.",
   523: "The session was closed.",
   768: "The server rejected the connection request.",
-  769: "Authentication failed — check the credentials or SSH key.",
+  769: "Authentication failed - check the credentials or SSH key.",
   771: "Access to this connection was refused.",
   776: "The session was closed after a period of inactivity.",
   781: "The connection was closed because the client fell behind.",
@@ -110,7 +110,7 @@ export function openConsole(
 
   // Guacamole.Client.State: 0 IDLE, 1 CONNECTING, 2 WAITING, 3 CONNECTED,
   // 4 DISCONNECTING, 5 DISCONNECTED. CONNECTING and WAITING are one state to an
-  // operator — both mean "not usable yet".
+  // operator - both mean "not usable yet".
   client.onstatechange = (state: number) => {
     if (closing) return;
     if (state === 1 || state === 2) handlers.onState?.("connecting");

web/lib/keyLifetime.ts

@@ -30,7 +30,7 @@ function shortDate(d: Date) {
 
 /**
  * `capDays` is the instance's current `api_token_max_days`, 0 when unset. It is
- * never applied retroactively — a token issued before the cap tightened keeps
+ * never applied retroactively - a token issued before the cap tightened keeps
  * working, and `outsidePolicy` is a prompt to rotate rather than a failure of
  * any kind. Copy built on this flag must not imply the key has stopped working.
  */

web/lib/query-client.ts

@@ -7,7 +7,7 @@ export const queryClient = new QueryClient({
     queries: {
       staleTime: 30_000,
       retry: 1,
-      // Several pages poll on an interval — the fleet list every 30s, run logs
+      // Several pages poll on an interval - the fleet list every 30s, run logs
       // faster than that. A hidden tab was still doing all of it, so a console
       // left open overnight in a background tab kept refetching the fleet and
       // its inventory blobs until the session expired. The default here rather

web/lib/targets.ts

@@ -10,7 +10,7 @@ import { Server } from "@/lib/api";
  * change in the same commit as it.
  *
  * It lives here rather than in a component because it had already been written
- * twice — once in the designer and once, wrongly, on the workflows list, where
+ * twice - once in the designer and once, wrongly, on the workflows list, where
  * the count ignored tags entirely and a tag-only workflow reported zero targets.
  */