refactor: enforce strict architecture rules and add Pydantic response models

- Update architecture rules to be stricter (API-003 now blocks ALL exception
  raising in endpoints, not just HTTPException)
- Update get_current_vendor_api dependency to guarantee token_vendor_id presence
- Remove redundant _get_vendor_from_token helpers from all vendor API files
- Move vendor access validation to service layer methods
- Add Pydantic response models for media, notification, and payment endpoints
- Add get_active_vendor_by_code service method for public vendor lookup
- Add get_import_job_for_vendor service method with vendor validation
- Update validation script to detect exception raising patterns in endpoints

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

docs/api/authentication.md

@@ -453,14 +453,37 @@ current_user: User = Depends(get_current_vendor_from_cookie_or_header)
 
 **Purpose:** Authenticate vendor users for API endpoints
 **Accepts:** Authorization header ONLY
-**Returns:** `User` object with `role="vendor"`
+**Returns:** `User` object with `role="vendor"` and **guaranteed** attributes:
+- `current_user.token_vendor_id` - Vendor ID from JWT token
+- `current_user.token_vendor_code` - Vendor code from JWT token
+- `current_user.token_vendor_role` - User's role in vendor (owner, manager, etc.)
+
 **Raises:**
-- `InvalidTokenException` - No token or invalid token
-- `InsufficientPermissionsException` - User is not vendor or is admin
+- `InvalidTokenException` - No token, invalid token, or **missing vendor context in token**
+- `InsufficientPermissionsException` - User is not vendor, is admin, or lost access to vendor
+
+**Guarantees:**
+This dependency **guarantees** that `token_vendor_id` is present. Endpoints should NOT check for its existence:
+
+```python
+# ❌ WRONG - Redundant check violates API-003
+if not hasattr(current_user, "token_vendor_id"):
+    raise InvalidTokenException("...")
+
+# ✅ CORRECT - Dependency guarantees this attribute exists
+vendor_id = current_user.token_vendor_id
+```
 
 **Usage:**
 ```python
-current_user: User = Depends(get_current_vendor_api)
+@router.get("/orders")
+def get_orders(
+    current_user: User = Depends(get_current_vendor_api),
+    db: Session = Depends(get_db),
+):
+    # Safe to use directly - dependency guarantees token_vendor_id
+    orders = order_service.get_vendor_orders(db, current_user.token_vendor_id)
+    return orders
 ```
 
 #### `get_current_customer_from_cookie_or_header()`