refactor: enforce strict architecture rules and add Pydantic response models

- Update architecture rules to be stricter (API-003 now blocks ALL exception
  raising in endpoints, not just HTTPException)
- Update get_current_vendor_api dependency to guarantee token_vendor_id presence
- Remove redundant _get_vendor_from_token helpers from all vendor API files
- Move vendor access validation to service layer methods
- Add Pydantic response models for media, notification, and payment endpoints
- Add get_active_vendor_by_code service method for public vendor lookup
- Add get_import_job_for_vendor service method with vendor validation
- Update validation script to detect exception raising patterns in endpoints

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

app/api/v1/vendor/notifications.py

@@ -1,9 +1,9 @@
-# Notification management
 # app/api/v1/vendor/notifications.py
 """
 Vendor notification management endpoints.
 
-Vendor Context: Uses token_vendor_id from JWT token (authenticated vendor API pattern)
+Vendor Context: Uses token_vendor_id from JWT token (authenticated vendor API pattern).
+The get_current_vendor_api dependency guarantees token_vendor_id is present.
 """
 
 import logging
@@ -13,22 +13,24 @@ from sqlalchemy.orm import Session
 
 from app.api.deps import get_current_vendor_api
 from app.core.database import get_db
-from app.exceptions import InvalidTokenException
 from app.services.vendor_service import vendor_service
 from models.database.user import User
+from models.schema.notification import (
+    MessageResponse,
+    NotificationListResponse,
+    NotificationSettingsResponse,
+    NotificationSettingsUpdate,
+    NotificationTemplateListResponse,
+    NotificationTemplateUpdate,
+    TestNotificationRequest,
+    UnreadCountResponse,
+)
 
 router = APIRouter(prefix="/notifications")
 logger = logging.getLogger(__name__)
 
 
-def _get_vendor_from_token(current_user: User, db: Session):
-    """Helper to get vendor from JWT token."""
-    if not hasattr(current_user, "token_vendor_id"):
-        raise InvalidTokenException("Token missing vendor information. Please login again.")
-    return vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)
-
-
-@router.get("")
+@router.get("", response_model=NotificationListResponse)
 def get_notifications(
     skip: int = Query(0, ge=0),
     limit: int = Query(50, ge=1, le=100),
@@ -45,16 +47,16 @@ def get_notifications(
     - Support pagination
     - Return notification details
     """
-    vendor = _get_vendor_from_token(current_user, db)  # noqa: F841 - vendor will be used when implemented
-    return {
-        "notifications": [],
-        "total": 0,
-        "unread_count": 0,
-        "message": "Notifications coming in Slice 5",
-    }
+    vendor = vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)  # noqa: F841
+    return NotificationListResponse(
+        notifications=[],
+        total=0,
+        unread_count=0,
+        message="Notifications coming in Slice 5",
+    )
 
 
-@router.get("/unread-count")
+@router.get("/unread-count", response_model=UnreadCountResponse)
 def get_unread_count(
     current_user: User = Depends(get_current_vendor_api),
     db: Session = Depends(get_db),
@@ -66,11 +68,11 @@ def get_unread_count(
     - Count unread notifications for vendor
     - Used for notification badge
     """
-    vendor = _get_vendor_from_token(current_user, db)  # noqa: F841 - vendor will be used when implemented
-    return {"unread_count": 0, "message": "Unread count coming in Slice 5"}
+    vendor = vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)  # noqa: F841
+    return UnreadCountResponse(unread_count=0, message="Unread count coming in Slice 5")
 
 
-@router.put("/{notification_id}/read")
+@router.put("/{notification_id}/read", response_model=MessageResponse)
 def mark_as_read(
     notification_id: int,
     current_user: User = Depends(get_current_vendor_api),
@@ -83,11 +85,11 @@ def mark_as_read(
     - Mark single notification as read
     - Update read timestamp
     """
-    vendor = _get_vendor_from_token(current_user, db)  # noqa: F841 - vendor will be used when implemented
-    return {"message": "Mark as read coming in Slice 5"}
+    vendor = vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)  # noqa: F841
+    return MessageResponse(message="Mark as read coming in Slice 5")
 
 
-@router.put("/mark-all-read")
+@router.put("/mark-all-read", response_model=MessageResponse)
 def mark_all_as_read(
     current_user: User = Depends(get_current_vendor_api),
     db: Session = Depends(get_db),
@@ -99,11 +101,11 @@ def mark_all_as_read(
     - Mark all vendor notifications as read
     - Update timestamps
     """
-    vendor = _get_vendor_from_token(current_user, db)  # noqa: F841 - vendor will be used when implemented
-    return {"message": "Mark all as read coming in Slice 5"}
+    vendor = vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)  # noqa: F841
+    return MessageResponse(message="Mark all as read coming in Slice 5")
 
 
-@router.delete("/{notification_id}")
+@router.delete("/{notification_id}", response_model=MessageResponse)
 def delete_notification(
     notification_id: int,
     current_user: User = Depends(get_current_vendor_api),
@@ -116,11 +118,11 @@ def delete_notification(
     - Delete single notification
     - Verify notification belongs to vendor
     """
-    vendor = _get_vendor_from_token(current_user, db)  # noqa: F841 - vendor will be used when implemented
-    return {"message": "Notification deletion coming in Slice 5"}
+    vendor = vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)  # noqa: F841
+    return MessageResponse(message="Notification deletion coming in Slice 5")
 
 
-@router.get("/settings")
+@router.get("/settings", response_model=NotificationSettingsResponse)
 def get_notification_settings(
     current_user: User = Depends(get_current_vendor_api),
     db: Session = Depends(get_db),
@@ -133,18 +135,18 @@ def get_notification_settings(
     - Get in-app notification settings
     - Get notification types enabled/disabled
     """
-    vendor = _get_vendor_from_token(current_user, db)  # noqa: F841 - vendor will be used when implemented
-    return {
-        "email_notifications": True,
-        "in_app_notifications": True,
-        "notification_types": {},
-        "message": "Notification settings coming in Slice 5",
-    }
+    vendor = vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)  # noqa: F841
+    return NotificationSettingsResponse(
+        email_notifications=True,
+        in_app_notifications=True,
+        notification_types={},
+        message="Notification settings coming in Slice 5",
+    )
 
 
-@router.put("/settings")
+@router.put("/settings", response_model=MessageResponse)
 def update_notification_settings(
-    settings: dict,
+    settings: NotificationSettingsUpdate,
     current_user: User = Depends(get_current_vendor_api),
     db: Session = Depends(get_db),
 ):
@@ -156,11 +158,11 @@ def update_notification_settings(
     - Update in-app notification settings
     - Enable/disable specific notification types
     """
-    vendor = _get_vendor_from_token(current_user, db)  # noqa: F841 - vendor will be used when implemented
-    return {"message": "Notification settings update coming in Slice 5"}
+    vendor = vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)  # noqa: F841
+    return MessageResponse(message="Notification settings update coming in Slice 5")
 
 
-@router.get("/templates")
+@router.get("/templates", response_model=NotificationTemplateListResponse)
 def get_notification_templates(
     current_user: User = Depends(get_current_vendor_api),
     db: Session = Depends(get_db),
@@ -173,14 +175,16 @@ def get_notification_templates(
     - Include: order confirmation, shipping notification, etc.
     - Return template details
     """
-    vendor = _get_vendor_from_token(current_user, db)  # noqa: F841 - vendor will be used when implemented
-    return {"templates": [], "message": "Notification templates coming in Slice 5"}
+    vendor = vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)  # noqa: F841
+    return NotificationTemplateListResponse(
+        templates=[], message="Notification templates coming in Slice 5"
+    )
 
 
-@router.put("/templates/{template_id}")
+@router.put("/templates/{template_id}", response_model=MessageResponse)
 def update_notification_template(
     template_id: int,
-    template_data: dict,
+    template_data: NotificationTemplateUpdate,
     current_user: User = Depends(get_current_vendor_api),
     db: Session = Depends(get_db),
 ):
@@ -193,13 +197,13 @@ def update_notification_template(
     - Validate template variables
     - Preview template
     """
-    vendor = _get_vendor_from_token(current_user, db)  # noqa: F841 - vendor will be used when implemented
-    return {"message": "Template update coming in Slice 5"}
+    vendor = vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)  # noqa: F841
+    return MessageResponse(message="Template update coming in Slice 5")
 
 
-@router.post("/test")
+@router.post("/test", response_model=MessageResponse)
 def send_test_notification(
-    notification_data: dict,
+    notification_data: TestNotificationRequest,
     current_user: User = Depends(get_current_vendor_api),
     db: Session = Depends(get_db),
 ):
@@ -211,5 +215,5 @@ def send_test_notification(
     - Use specified template
     - Send to current user's email
     """
-    vendor = _get_vendor_from_token(current_user, db)  # noqa: F841 - vendor will be used when implemented
-    return {"message": "Test notification coming in Slice 5"}
+    vendor = vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)  # noqa: F841
+    return MessageResponse(message="Test notification coming in Slice 5")