refactor: enforce strict architecture rules and add Pydantic response models

- Update architecture rules to be stricter (API-003 now blocks ALL exception
  raising in endpoints, not just HTTPException)
- Update get_current_vendor_api dependency to guarantee token_vendor_id presence
- Remove redundant _get_vendor_from_token helpers from all vendor API files
- Move vendor access validation to service layer methods
- Add Pydantic response models for media, notification, and payment endpoints
- Add get_active_vendor_by_code service method for public vendor lookup
- Add get_import_job_for_vendor service method with vendor validation
- Update validation script to detect exception raising patterns in endpoints

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

app/api/v1/vendor/payments.py

@@ -1,9 +1,9 @@
-# Payment configuration and processing
 # app/api/v1/vendor/payments.py
 """
 Vendor payment configuration and processing endpoints.
 
-Vendor Context: Uses token_vendor_id from JWT token (authenticated vendor API pattern)
+Vendor Context: Uses token_vendor_id from JWT token (authenticated vendor API pattern).
+The get_current_vendor_api dependency guarantees token_vendor_id is present.
 """
 
 import logging
@@ -13,22 +13,27 @@ from sqlalchemy.orm import Session
 
 from app.api.deps import get_current_vendor_api
 from app.core.database import get_db
-from app.exceptions import InvalidTokenException
 from app.services.vendor_service import vendor_service
 from models.database.user import User
+from models.schema.payment import (
+    PaymentBalanceResponse,
+    PaymentConfigResponse,
+    PaymentConfigUpdate,
+    PaymentConfigUpdateResponse,
+    PaymentMethodsResponse,
+    RefundRequest,
+    RefundResponse,
+    StripeConnectRequest,
+    StripeConnectResponse,
+    StripeDisconnectResponse,
+    TransactionsResponse,
+)
 
 router = APIRouter(prefix="/payments")
 logger = logging.getLogger(__name__)
 
 
-def _get_vendor_from_token(current_user: User, db: Session):
-    """Helper to get vendor from JWT token."""
-    if not hasattr(current_user, "token_vendor_id"):
-        raise InvalidTokenException("Token missing vendor information. Please login again.")
-    return vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)
-
-
-@router.get("/config")
+@router.get("/config", response_model=PaymentConfigResponse)
 def get_payment_configuration(
     current_user: User = Depends(get_current_vendor_api),
     db: Session = Depends(get_db),
@@ -42,19 +47,19 @@ def get_payment_configuration(
     - Get currency settings
     - Return masked/secure information only
     """
-    vendor = _get_vendor_from_token(current_user, db)  # noqa: F841 - vendor will be used when implemented
-    return {
-        "payment_gateway": None,
-        "accepted_methods": [],
-        "currency": "EUR",
-        "stripe_connected": False,
-        "message": "Payment configuration coming in Slice 5",
-    }
+    vendor = vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)  # noqa: F841
+    return PaymentConfigResponse(
+        payment_gateway=None,
+        accepted_methods=[],
+        currency="EUR",
+        stripe_connected=False,
+        message="Payment configuration coming in Slice 5",
+    )
 
 
-@router.put("/config")
+@router.put("/config", response_model=PaymentConfigUpdateResponse)
 def update_payment_configuration(
-    payment_config: dict,
+    payment_config: PaymentConfigUpdate,
     current_user: User = Depends(get_current_vendor_api),
     db: Session = Depends(get_db),
 ):
@@ -67,13 +72,15 @@ def update_payment_configuration(
     - Update accepted payment methods
     - Validate configuration before saving
     """
-    vendor = _get_vendor_from_token(current_user, db)  # noqa: F841 - vendor will be used when implemented
-    return {"message": "Payment configuration update coming in Slice 5"}
+    vendor = vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)  # noqa: F841
+    return PaymentConfigUpdateResponse(
+        message="Payment configuration update coming in Slice 5"
+    )
 
 
-@router.post("/stripe/connect")
+@router.post("/stripe/connect", response_model=StripeConnectResponse)
 def connect_stripe_account(
-    stripe_data: dict,
+    stripe_data: StripeConnectRequest,
     current_user: User = Depends(get_current_vendor_api),
     db: Session = Depends(get_db),
 ):
@@ -86,11 +93,11 @@ def connect_stripe_account(
     - Verify Stripe account is active
     - Enable payment processing
     """
-    vendor = _get_vendor_from_token(current_user, db)  # noqa: F841 - vendor will be used when implemented
-    return {"message": "Stripe connection coming in Slice 5"}
+    vendor = vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)  # noqa: F841
+    return StripeConnectResponse(message="Stripe connection coming in Slice 5")
 
 
-@router.delete("/stripe/disconnect")
+@router.delete("/stripe/disconnect", response_model=StripeDisconnectResponse)
 def disconnect_stripe_account(
     current_user: User = Depends(get_current_vendor_api),
     db: Session = Depends(get_db),
@@ -103,11 +110,11 @@ def disconnect_stripe_account(
     - Disable payment processing
     - Warn about pending payments
     """
-    vendor = _get_vendor_from_token(current_user, db)  # noqa: F841 - vendor will be used when implemented
-    return {"message": "Stripe disconnection coming in Slice 5"}
+    vendor = vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)  # noqa: F841
+    return StripeDisconnectResponse(message="Stripe disconnection coming in Slice 5")
 
 
-@router.get("/methods")
+@router.get("/methods", response_model=PaymentMethodsResponse)
 def get_payment_methods(
     current_user: User = Depends(get_current_vendor_api),
     db: Session = Depends(get_db),
@@ -119,11 +126,14 @@ def get_payment_methods(
     - Return list of enabled payment methods
     - Include: credit card, PayPal, bank transfer, etc.
     """
-    vendor = _get_vendor_from_token(current_user, db)  # noqa: F841 - vendor will be used when implemented
-    return {"methods": [], "message": "Payment methods coming in Slice 5"}
+    vendor = vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)  # noqa: F841
+    return PaymentMethodsResponse(
+        methods=[],
+        message="Payment methods coming in Slice 5",
+    )
 
 
-@router.get("/transactions")
+@router.get("/transactions", response_model=TransactionsResponse)
 def get_payment_transactions(
     current_user: User = Depends(get_current_vendor_api),
     db: Session = Depends(get_db),
@@ -137,15 +147,15 @@ def get_payment_transactions(
     - Include payment details
     - Support pagination
     """
-    vendor = _get_vendor_from_token(current_user, db)  # noqa: F841 - vendor will be used when implemented
-    return {
-        "transactions": [],
-        "total": 0,
-        "message": "Payment transactions coming in Slice 5",
-    }
+    vendor = vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)  # noqa: F841
+    return TransactionsResponse(
+        transactions=[],
+        total=0,
+        message="Payment transactions coming in Slice 5",
+    )
 
 
-@router.get("/balance")
+@router.get("/balance", response_model=PaymentBalanceResponse)
 def get_payment_balance(
     current_user: User = Depends(get_current_vendor_api),
     db: Session = Depends(get_db),
@@ -159,20 +169,20 @@ def get_payment_balance(
     - Get next payout date
     - Get payout history
     """
-    vendor = _get_vendor_from_token(current_user, db)  # noqa: F841 - vendor will be used when implemented
-    return {
-        "available_balance": 0.0,
-        "pending_balance": 0.0,
-        "currency": "EUR",
-        "next_payout_date": None,
-        "message": "Payment balance coming in Slice 5",
-    }
+    vendor = vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)  # noqa: F841
+    return PaymentBalanceResponse(
+        available_balance=0.0,
+        pending_balance=0.0,
+        currency="EUR",
+        next_payout_date=None,
+        message="Payment balance coming in Slice 5",
+    )
 
 
-@router.post("/refund/{payment_id}")
+@router.post("/refund/{payment_id}", response_model=RefundResponse)
 def refund_payment(
     payment_id: int,
-    refund_data: dict,
+    refund_data: RefundRequest,
     current_user: User = Depends(get_current_vendor_api),
     db: Session = Depends(get_db),
 ):
@@ -185,5 +195,5 @@ def refund_payment(
     - Update order status
     - Send refund notification to customer
     """
-    vendor = _get_vendor_from_token(current_user, db)  # noqa: F841 - vendor will be used when implemented
-    return {"message": "Payment refund coming in Slice 5"}
+    vendor = vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)  # noqa: F841
+    return RefundResponse(message="Payment refund coming in Slice 5")