fix: resolve architecture validation errors and warnings

- Fix JS-008: Replace raw fetch() with apiClient in letzshop-vendor-directory.js
- Fix JS-005: Add init guard to letzshop-vendor-directory.js
- Fix JS-004: Increase search region in validator (800→2000 chars) to detect
  currentPage in files with setup code before return statement
- Fix JS-001: Use centralized logger in media-picker.js
- Fix API-002: Move database query from onboarding.py to order_service.py
- Fix FE-001: Add noqa comment to search.html (shop uses custom themed pagination)
- Add audit validator to validate_all.py script
- Update frontend.yaml with vendor exclusion pattern

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

scripts/validate_all.py

@@ -2,7 +2,7 @@
 """
 Unified Code Validator
 ======================
-Runs all validation scripts (architecture, security, performance) in sequence.
+Runs all validation scripts (architecture, security, performance, audit) in sequence.
 
 This provides a single entry point for comprehensive code validation,
 useful for CI/CD pipelines and pre-commit hooks.
@@ -12,6 +12,7 @@ Usage:
     python scripts/validate_all.py --security        # Run only security validator
     python scripts/validate_all.py --performance     # Run only performance validator
     python scripts/validate_all.py --architecture    # Run only architecture validator
+    python scripts/validate_all.py --audit           # Run only audit validator
     python scripts/validate_all.py -v                # Verbose output
     python scripts/validate_all.py --fail-fast       # Stop on first failure
     python scripts/validate_all.py --json            # JSON output
@@ -20,6 +21,7 @@ Options:
     --architecture      Run architecture validator
     --security          Run security validator
     --performance       Run performance validator
+    --audit             Run audit validator
     --fail-fast         Stop on first validator failure
     -v, --verbose       Show detailed output
     --errors-only       Only show errors
@@ -116,6 +118,32 @@ def run_performance_validator(verbose: bool = False) -> tuple[int, dict]:
         return 1, {"name": "Performance", "error": str(e)}
 
 
+def run_audit_validator(verbose: bool = False) -> tuple[int, dict]:
+    """Run the audit validator"""
+    try:
+        from validate_audit import AuditValidator
+
+        validator = AuditValidator()
+        has_errors = not validator.validate()
+
+        return (
+            1 if has_errors else 0,
+            {
+                "name": "Audit",
+                "files_checked": len(validator.files_checked) if hasattr(validator, 'files_checked') else 0,
+                "errors": len(validator.errors),
+                "warnings": len(validator.warnings),
+                "info": len(validator.info) if hasattr(validator, 'info') else 0,
+            }
+        )
+    except ImportError as e:
+        print(f"⚠️  Audit validator not available: {e}")
+        return 0, {"name": "Audit", "skipped": True}
+    except Exception as e:
+        print(f"❌ Audit validator failed: {e}")
+        return 1, {"name": "Audit", "error": str(e)}
+
+
 def print_summary(results: list[dict], json_output: bool = False):
     """Print validation summary"""
     if json_output:
@@ -163,12 +191,13 @@ def print_summary(results: list[dict], json_output: bool = False):
 
 def main():
     parser = argparse.ArgumentParser(
-        description="Unified code validator - runs architecture, security, and performance checks",
+        description="Unified code validator - runs architecture, security, performance, and audit checks",
         formatter_class=argparse.RawDescriptionHelpFormatter,
     )
     parser.add_argument("--architecture", action="store_true", help="Run architecture validator")
     parser.add_argument("--security", action="store_true", help="Run security validator")
     parser.add_argument("--performance", action="store_true", help="Run performance validator")
+    parser.add_argument("--audit", action="store_true", help="Run audit validator")
     parser.add_argument("--fail-fast", action="store_true", help="Stop on first failure")
     parser.add_argument("-v", "--verbose", action="store_true", help="Verbose output")
     parser.add_argument("--errors-only", action="store_true", help="Only show errors")
@@ -177,7 +206,7 @@ def main():
     args = parser.parse_args()
 
     # If no specific validators selected, run all
-    run_all = not (args.architecture or args.security or args.performance)
+    run_all = not (args.architecture or args.security or args.performance or args.audit)
 
     print("\n🔍 UNIFIED CODE VALIDATION")
     print("=" * 80)
@@ -189,6 +218,8 @@ def main():
         validators.append(("Security", run_security_validator))
     if run_all or args.performance:
         validators.append(("Performance", run_performance_validator))
+    if run_all or args.audit:
+        validators.append(("Audit", run_audit_validator))
 
     results = []
     exit_code = 0

scripts/validate_architecture.py

@@ -615,7 +615,8 @@ class ArchitectureValidator:
             line_num = content[:func_start].count("\n") + 1
 
             # Check if currentPage is set in the return object
-            search_region = content[func_start : func_start + 800]
+            # Use larger region to handle functions with setup code before return
+            search_region = content[func_start : func_start + 2000]
             if "return {" in search_region:
                 return_match = re.search(
                     r"return\s*\{([^}]{0,500})", search_region, re.DOTALL
@@ -2913,10 +2914,11 @@ class ArchitectureValidator:
         self.result.files_checked += len(js_files)
 
         for file_path in js_files:
-            # Skip third-party vendor libraries
-            if "/vendor/" in str(file_path) and file_path.suffix == ".js":
-                if any(x in file_path.name for x in [".min.js", "chart.", "alpine."]):
-                    continue
+            # Skip third-party libraries in static/shared/js/lib/
+            # Note: static/vendor/js/ is our app's vendor dashboard code (NOT third-party)
+            file_path_str = str(file_path)
+            if "/shared/js/lib/" in file_path_str or "\\shared\\js\\lib\\" in file_path_str:
+                continue
 
             content = file_path.read_text()
             lines = content.split("\n")