chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

web/lib/api.ts

@@ -180,7 +180,7 @@ export type ChannelType = "webhook" | "smtp" | "discord" | "slack" | "telegram";
  * written verbatim.
  *
  * Mirrors `models.RedactedSecret` and `models.channelSecretKeys` in
- * `server/internal/models/channel.go` — change both in the same commit, the
+ * `server/internal/models/channel.go` - change both in the same commit, the
  * same hazard as the mirrored token blocks.
  */
 export const REDACTED_SECRET = "••••••••";
@@ -304,7 +304,7 @@ export type ApiToken = {
     user_id: string;
     user_email?: string;
     /** Restricts the token to servers carrying every pair. Absent or empty is
-     *  the whole fleet — the asymmetry is deliberate, see services.MatchesSelector. */
+     *  the whole fleet - the asymmetry is deliberate, see services.MatchesSelector. */
     tag_selector?: Record<string, string> | null;
 };
 
@@ -1147,7 +1147,7 @@ export interface VulnFinding {
     cve_id: string;
     package_name: string;
     installed_version: string;
-    /** Absent means no vendor fix is published — a real state, not missing data. */
+    /** Absent means no vendor fix is published - a real state, not missing data. */
     fixed_in?: string;
     severity: Severity;
     cvss_score?: number;
@@ -1385,7 +1385,7 @@ export interface Skip {
 // Public status page types
 //
 // These mirror services.StatusSnapshot and friends in
-// server/internal/services/statussnapshot.go field for field — that Go file
+// server/internal/services/statussnapshot.go field for field - that Go file
 // is the contract. They back the anonymous /status/[pageId] page, which is
 // deliberately outside the (app) route group and never calls `request()`
 // (no session, no auth). Task 10 adds the authoring types and api client