fix: remove vendorCode from vendor API paths

Vendor API endpoints use JWT authentication, not URL path parameters.
The vendorCode should only be used for page URLs (navigation), not API calls.

Fixed API paths in 10 vendor JS files:
- analytics.js, customers.js, inventory.js, notifications.js
- order-detail.js, orders.js, products.js, profile.js
- settings.js, team.js

Added architecture rule JS-014 to prevent this pattern from recurring.
Added validation check _check_vendor_api_paths to validate_architecture.py.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

static/vendor/js/profile.js

@@ -78,7 +78,7 @@ function vendorProfile() {
             this.error = '';
 
             try {
-                const response = await apiClient.get(`/vendor/${this.vendorCode}/profile`);
+                const response = await apiClient.get(`/vendor/profile`);
 
                 this.profile = response;
                 this.form = {
@@ -159,7 +159,7 @@ function vendorProfile() {
 
             this.saving = true;
             try {
-                await apiClient.put(`/vendor/${this.vendorCode}/profile`, this.form);
+                await apiClient.put(`/vendor/profile`, this.form);
 
                 Utils.showToast('Profile updated successfully', 'success');
                 vendorProfileLog.info('Profile updated');