chore(typo): retire tous les tirets cadratins/demi-cadratins + garde CI

Remplace les 547 tirets cadratins (U+2014) et demi-cadratins (U+2013) des fichiers versionnés par la ponctuation contextuelle adaptée (point médian, deux-points, virgule, parenthèses ; tiret simple pour les plages), sur 122 fichiers (appli, vitrine, doc, tests, workflows, scripts).

Ajoute le job CI « lint-dashes » (git grep -P) qui échoue si un tiret cadratin/demi-cadratin réapparaît, hors logo binaire et captures brutes du terminal (fidélité des fixtures de détection de dialogue).

docs/ENTERPRISE_DEPLOYMENT.md

@@ -25,7 +25,7 @@ is **never** a deployment mode and is never injected automatically by `arboretum
 ## 2. Encryption at rest
 
 Sensitive secrets (the HMAC server secret and the VAPID private key) are encrypted with AES-256-GCM
-before being stored in SQLite. Token values are never stored — only their SHA-256 hashes.
+before being stored in SQLite. Token values are never stored, only their SHA-256 hashes.
 
 For **strong** protection (key not co-located with the database), provide a passphrase via the
 environment instead of the on-disk key file:
@@ -64,7 +64,7 @@ curl -s -H "Authorization: Bearer $TOKEN" \
   'http://127.0.0.1:7317/api/v1/audit-logs?limit=100'
 ```
 
-The audit log never contains secret values — only non-sensitive metadata (ids, labels, counters). It is
+The audit log never contains secret values, only non-sensitive metadata (ids, labels, counters). It is
 also visible in the dashboard under **Settings → Security & compliance**.
 
 ## 5. GDPR (data subject requests)
@@ -72,14 +72,14 @@ also visible in the dashboard under **Settings → Security & compliance**.
 - **Export**: `GET /api/v1/data/export` returns every record tied to the authenticated token (token
   metadata, push subscriptions, session history, settings) as JSON. Also available as a one-click
   download in **Settings → Security & compliance**.
-- **Erasure**: `POST /api/v1/data/delete-my-data` is a two-step call — the first response returns a
+- **Erasure**: `POST /api/v1/data/delete-my-data` is a two-step call: the first response returns a
   `confirm` code that must be POSTed back to execute. It purges the token's push subscriptions and
   revokes the token (unless it is the last active one).
 
 ## 6. Backups & retention
 
 - Back up the SQLite database (`arboretum.db`) with the WAL checkpointed. Treat backups as sensitive.
-- If you use `ARBORETUM_SECRET_KEY`, back the key up **separately** — a database backup is useless (and
+- If you use `ARBORETUM_SECRET_KEY`, back the key up **separately**: a database backup is useless (and
   safe) without it, which is the point.
 - Session history is retained until the database is reset. To start clean, stop the service and remove
   the database file.