fix: remove vendorCode from vendor API paths

Vendor API endpoints use JWT authentication, not URL path parameters.
The vendorCode should only be used for page URLs (navigation), not API calls.

Fixed API paths in 10 vendor JS files:
- analytics.js, customers.js, inventory.js, notifications.js
- order-detail.js, orders.js, products.js, profile.js
- settings.js, team.js

Added architecture rule JS-014 to prevent this pattern from recurring.
Added validation check _check_vendor_api_paths to validate_architecture.py.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

static/vendor/js/analytics.js

@@ -107,7 +107,7 @@ function vendorAnalytics() {
          */
         async fetchAnalytics() {
             try {
-                const response = await apiClient.get(`/vendor/${this.vendorCode}/analytics?period=${this.period}`);
+                const response = await apiClient.get(`/vendor/analytics?period=${this.period}`);
                 return response;
             } catch (error) {
                 // Analytics might require feature access
@@ -124,7 +124,7 @@ function vendorAnalytics() {
          */
         async fetchStats() {
             try {
-                const response = await apiClient.get(`/vendor/${this.vendorCode}/dashboard/stats`);
+                const response = await apiClient.get(`/vendor/dashboard/stats`);
                 return {
                     total_products: response.catalog?.total_products || 0,
                     active_products: response.catalog?.active_products || 0,