feat: add JS-009 rule for Utils.showToast() and update naming docs

Architecture rules:
- Add JS-009: Use Utils.showToast() instead of alert() or window.showToast
- Supports inline noqa comments to suppress warnings

Documentation:
- Update naming-conventions.md to emphasize plural table names (industry standard)
- Document that plural table names follow Rails/Django/Laravel conventions

Schema:
- Add from_attributes to VendorUserResponse for ORM compatibility

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.architecture-rules.yaml

@@ -348,13 +348,23 @@ model_rules:
         - "from_attributes = True"
 
   - id: "MDL-004"
-    name: "Database models use singular table names"
+    name: "Database tables use plural names"
     severity: "warning"
     description: |
-      Database table names should be singular lowercase (e.g., 'vendor' not 'vendors').
+      Database table names should be plural lowercase following industry standard
+      conventions (Rails, Django, Laravel, most ORMs). A table represents a
+      collection of entities, so plural names are natural: 'users', 'orders',
+      'products'. This reads naturally in SQL: SELECT * FROM users WHERE id = 1.
+
+      Examples:
+        - Good: users, vendors, products, orders, order_items, cart_items
+        - Bad: user, vendor, product, order
+
+      Junction/join tables use both entity names in plural:
+        - Good: vendor_users, order_items, product_translations
     pattern:
       file_pattern: "models/database/**/*.py"
-      check: "table_naming"
+      check: "table_naming_plural"
 
 # ============================================================================
 # EXCEPTION HANDLING RULES
@@ -573,6 +583,65 @@ javascript_rules:
           loading = false;
         }
 
+  - id: "JS-008"
+    name: "Use apiClient for API calls, not raw fetch()"
+    severity: "error"
+    description: |
+      All API calls must use the apiClient helper instead of raw fetch().
+      The apiClient automatically:
+      - Adds Authorization header with JWT token from cookies
+      - Sets Content-Type headers
+      - Handles error responses consistently
+      - Provides logging integration
+
+      WRONG (raw fetch):
+        const response = await fetch('/api/v1/admin/products/123');
+
+      RIGHT (apiClient):
+        const response = await apiClient.get('/admin/products/123');
+        const result = await apiClient.post('/admin/products', data);
+        await apiClient.delete('/admin/products/123');
+    pattern:
+      file_pattern: "static/**/js/**/*.js"
+      anti_patterns:
+        - "fetch\\('/api/"
+        - 'fetch\\("/api/'
+        - "fetch\\(`/api/"
+      exceptions:
+        - "init-api-client.js"  # The apiClient implementation itself
+
+  - id: "JS-009"
+    name: "Use Utils.showToast() for notifications, not alert() or window.showToast"
+    severity: "error"
+    description: |
+      All user notifications must use Utils.showToast() from static/shared/js/utils.js.
+      Never use browser alert() dialogs or undefined window.showToast.
+
+      Utils.showToast() provides:
+      - Consistent styling (Tailwind-based toast in bottom-right corner)
+      - Automatic fade-out after duration
+      - Color-coded types (success=green, error=red, warning=yellow, info=blue)
+
+      WRONG (browser dialog):
+        alert('Product saved successfully');
+        alert(errorMessage);
+
+      WRONG (undefined function):
+        window.showToast('Success', 'success');
+        if (window.showToast) { window.showToast(...); } else { alert(...); }
+
+      RIGHT (Utils helper):
+        Utils.showToast('Product saved successfully', 'success');
+        Utils.showToast('Failed to save product', 'error');
+        Utils.showToast('Please fill all required fields', 'warning');
+    pattern:
+      file_pattern: "static/**/js/**/*.js"
+      anti_patterns:
+        - "alert\\("
+        - "window\\.showToast"
+      exceptions:
+        - "utils.js"  # The Utils implementation itself
+
 # ============================================================================
 # TEMPLATE RULES (Jinja2)
 # ============================================================================