Rename to stealergram, add pyproject.toml, purge em-dashes

- Rename project to stealergram throughout
- Add pyproject.toml (replaces requirements.txt split, folds pytest.ini)
- Replace all em-dashes with hyphens across all source files

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_scorer.py

@@ -1,10 +1,10 @@
 """
-Tests for utils/scorer.py — severity scoring and ULP line parsing.
+Tests for utils/scorer.py - severity scoring and ULP line parsing.
 
 All tests use the `patched_keywords` fixture (see conftest.py) which
 replaces TARGET_KEYWORDS with two entries:
-  @testcorp.com  — employee email domain (CRITICAL trigger)
-  testcorp.com   — plain domain match    (LOW baseline)
+  @testcorp.com - employee email domain (CRITICAL trigger)
+  testcorp.com - plain domain match    (LOW baseline)
 """
 
 import pytest
@@ -50,7 +50,7 @@ class TestULPParsingRealWorld:
 
     @pytest.mark.parametrize("line,exp_url,exp_user,exp_pass", [
         # ── Protocol + port + path, colon separator ──────────────────────────
-        # Port is digits followed by '/' — must be consumed as part of the URL.
+        # Port is digits followed by '/' - must be consumed as part of the URL.
         (
             "http://portal.fakehosp.example.com:88/:55512309-1:hunter2",
             "http://portal.fakehosp.example.com:88/", "55512309-1", "hunter2",
@@ -91,7 +91,7 @@ class TestULPParsingRealWorld:
             "jdoe@fakehosp.example.com", "Passw0rd!",
         ),
 
-        # ── Pipe separator (unambiguous — port stays in URL) ──────────────────
+        # ── Pipe separator (unambiguous - port stays in URL) ──────────────────
         (
             "http://portal.fakehosp.example.com:88/|22.987.654-3|florida88",
             "http://portal.fakehosp.example.com:88/", "22.987.654-3", "florida88",
@@ -113,7 +113,7 @@ class TestULPParsingRealWorld:
             "portal.fakehosp.example.com:88/", "22.987.654-3", "florida88",
         ),
 
-        # ── No protocol, no port — plain colon separators ────────────────────
+        # ── No protocol, no port - plain colon separators ────────────────────
         (
             "booking.fakehosp.example.com:66778899-7:correcthorse",
             "booking.fakehosp.example.com", "66778899-7", "correcthorse",
@@ -234,7 +234,7 @@ class TestWeakPasswordFlags:
         assert any("Common password" in r for r in hit.reasons)
 
     def test_weak_password_does_not_escalate_severity(self, patched_keywords):
-        """Weak password flags are informational — they must not change severity."""
+        """Weak password flags are informational - they must not change severity."""
         hit = score_hit("testcorp.com|user|abc")
         assert hit.severity == LOW