chore(style): codebase em-dash sweep + minor layout polish

Replaces every em-dash and en-dash with regular ASCII hyphens
across comments, JSX strings, and dev-facing logs. Mostly cosmetic
but stops the inconsistent mix that crept in over the last few
months (some files used em-dashes in comments, others didn't,
some used both).

Bundles two small dashboard-layout tweaks that touch a couple of
already-modified files:
- (dashboard)/layout.tsx main padding goes from p-6 to pt-3 px-6
  pb-6 so page content sits closer to the topbar.
- Sidebar now receives the ports list it needs for the footer
  port switcher.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/api/helpers.ts

@@ -25,7 +25,7 @@ export interface AuthContext {
   userId: string;
   portId: string;
   portSlug: string;
-  /** true for super_admin users — bypasses all permission checks. */
+  /** true for super_admin users - bypasses all permission checks. */
   isSuperAdmin: boolean;
   /**
    * Effective permissions after role + port override deep-merge.
@@ -117,7 +117,7 @@ export function withAuth(
       // 3. Resolve port context.
       //    Port ID comes from the X-Port-Id header (set by the client after port
       //    selection), falling back to the user's default port from preferences.
-      //    It NEVER comes from the request body — SECURITY-GUIDELINES.md §2.1.
+      //    It NEVER comes from the request body - SECURITY-GUIDELINES.md §2.1.
       const portIdFromHeader = req.headers.get('X-Port-Id');
       const portId =
         portIdFromHeader ??
@@ -163,7 +163,7 @@ export function withAuth(
           ) as RolePermissions;
         }
 
-        // Per-user residential toggle — flips the residential domain on
+        // Per-user residential toggle - flips the residential domain on
         // top of whatever the role grants. We never use it to *revoke*
         // residential access from a role that already grants it.
         if (portRole.residentialAccess && permissions) {
@@ -181,7 +181,7 @@ export function withAuth(
         }
       } else if (profile.isSuperAdmin && portId) {
         // Super admin still needs portSlug for response context.
-        // We also validate the portId actually exists — a super-admin session
+        // We also validate the portId actually exists - a super-admin session
         // must not be able to operate against a fabricated portId.
         const port = await db.query.ports.findFirst({
           where: eq(ports.id, portId),
@@ -237,7 +237,7 @@ export function withPermission(
       if (!resourcePerms || !resourcePerms[action]) {
         logger.warn({ userId: ctx.userId, resource, action }, 'Permission denied');
 
-        // Log the denied attempt — fire-and-forget; audit must never block response.
+        // Log the denied attempt - fire-and-forget; audit must never block response.
         void createAuditLog({
           userId: ctx.userId,
           portId: ctx.portId,
@@ -261,7 +261,7 @@ export function withPermission(
 
 /**
  * Wraps a route handler with a per-user rate-limit gate. Compose inside
- * withAuth so the userId is available — falls back to IP for anonymous
+ * withAuth so the userId is available - falls back to IP for anonymous
  * routes (we don't currently expose any).
  *
  * 429 responses include `X-RateLimit-Limit` / `Remaining` / `Reset` headers