refactor: migrate vendor APIs to token-based context and consolidate architecture

## Vendor-in-Token Architecture (Complete Migration)
- Migrate all vendor API endpoints from require_vendor_context() to token_vendor_id
- Update permission dependencies to extract vendor from JWT token
- Add vendor exceptions: VendorAccessDeniedException, VendorOwnerOnlyException,
  InsufficientVendorPermissionsException
- Shop endpoints retain require_vendor_context() for URL-based detection
- Add AUTH-004 architecture rule enforcing vendor context patterns
- Fix marketplace router missing /marketplace prefix

## Exception Pattern Fixes (API-003/API-004)
- Services raise domain exceptions, endpoints let them bubble up
- Add code_quality and content_page exception modules
- Move business logic from endpoints to services (admin, auth, content_page)
- Fix exception handling in admin, shop, and vendor endpoints

## Tailwind CSS Consolidation
- Consolidate CSS to per-area files (admin, vendor, shop, platform)
- Remove shared/cdn-fallback.html and shared/css/tailwind.min.css
- Update all templates to use area-specific Tailwind output files
- Remove Node.js config (package.json, postcss.config.js, tailwind.config.js)

## Documentation & Cleanup
- Update vendor-in-token-architecture.md with completed migration status
- Update architecture-rules.md with new rules
- Move migration docs to docs/development/migration/
- Remove duplicate/obsolete documentation files
- Merge pytest.ini settings into pyproject.toml

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

app/api/v1/vendor/marketplace.py

@@ -1,7 +1,8 @@
-# app/api/v1/vendor/marketplace.py  # Note: Should be under /vendor/ route
+# app/api/v1/vendor/marketplace.py
 """
 Marketplace import endpoints for vendors.
-Vendor context is automatically injected by middleware.
+
+Vendor Context: Uses token_vendor_id from JWT token (authenticated vendor API pattern)
 """
 
 import logging
@@ -11,37 +12,45 @@ from sqlalchemy.orm import Session
 
 from app.api.deps import get_current_vendor_api
 from app.core.database import get_db
+from app.exceptions import InvalidTokenException, UnauthorizedVendorAccessException
 from app.services.marketplace_import_job_service import marketplace_import_job_service
+from app.services.vendor_service import vendor_service
 from app.tasks.background_tasks import process_marketplace_import
 from middleware.decorators import rate_limit
-from middleware.vendor_context import require_vendor_context  # IMPORTANT
 from models.database.user import User
-from models.database.vendor import Vendor
 from models.schema.marketplace_import_job import (
     MarketplaceImportJobRequest,
     MarketplaceImportJobResponse,
 )
 
-router = APIRouter()
+router = APIRouter(prefix="/marketplace")
 logger = logging.getLogger(__name__)
 
 
+def _get_vendor_from_token(current_user: User, db: Session):
+    """Helper to get vendor from JWT token."""
+    if not hasattr(current_user, "token_vendor_id"):
+        raise InvalidTokenException("Token missing vendor information. Please login again.")
+    return vendor_service.get_vendor_by_id(db, current_user.token_vendor_id)
+
+
 @router.post("/import", response_model=MarketplaceImportJobResponse)
 @rate_limit(max_requests=10, window_seconds=3600)
 async def import_products_from_marketplace(
     request: MarketplaceImportJobRequest,
     background_tasks: BackgroundTasks,
-    vendor: Vendor = Depends(require_vendor_context()),  # ADDED: Vendor from middleware
     current_user: User = Depends(get_current_vendor_api),
     db: Session = Depends(get_db),
 ):
     """Import products from marketplace CSV with background processing (Protected)."""
+    vendor = _get_vendor_from_token(current_user, db)
+
     logger.info(
         f"Starting marketplace import: {request.marketplace} for vendor {vendor.vendor_code} "
         f"by user {current_user.username}"
     )
 
-    # Create import job (vendor comes from middleware)
+    # Create import job (vendor comes from token)
     import_job = marketplace_import_job_service.create_import_job(
         db, request, vendor, current_user
     )
@@ -50,9 +59,9 @@ async def import_products_from_marketplace(
     background_tasks.add_task(
         process_marketplace_import,
         import_job.id,
-        request.source_url,  # FIXED: was request.url
+        request.source_url,
         request.marketplace,
-        vendor.id,  # Pass vendor_id instead of vendor_code
+        vendor.id,
         request.batch_size or 1000,
     )
 
@@ -62,7 +71,7 @@ async def import_products_from_marketplace(
         marketplace=request.marketplace,
         vendor_id=import_job.vendor_id,
         vendor_code=vendor.vendor_code,
-        vendor_name=vendor.name,  # FIXED: from vendor object
+        vendor_name=vendor.name,
         source_url=request.source_url,
         message=f"Marketplace import started from {request.marketplace}. "
         f"Check status with /import-status/{import_job.id}",
@@ -77,17 +86,16 @@ async def import_products_from_marketplace(
 @router.get("/imports/{job_id}", response_model=MarketplaceImportJobResponse)
 def get_marketplace_import_status(
     job_id: int,
-    vendor: Vendor = Depends(require_vendor_context()),
     current_user: User = Depends(get_current_vendor_api),
     db: Session = Depends(get_db),
 ):
     """Get status of marketplace import job (Protected)."""
+    vendor = _get_vendor_from_token(current_user, db)
+
     job = marketplace_import_job_service.get_import_job_by_id(db, job_id, current_user)
 
     # Verify job belongs to current vendor
     if job.vendor_id != vendor.id:
-        from app.exceptions import UnauthorizedVendorAccessException
-
         raise UnauthorizedVendorAccessException(vendor.vendor_code, current_user.id)
 
     return marketplace_import_job_service.convert_to_response_model(job)
@@ -98,11 +106,12 @@ def get_marketplace_import_jobs(
     marketplace: str | None = Query(None, description="Filter by marketplace"),
     skip: int = Query(0, ge=0),
     limit: int = Query(50, ge=1, le=100),
-    vendor: Vendor = Depends(require_vendor_context()),
     current_user: User = Depends(get_current_vendor_api),
     db: Session = Depends(get_db),
 ):
     """Get marketplace import jobs for current vendor (Protected)."""
+    vendor = _get_vendor_from_token(current_user, db)
+
     jobs = marketplace_import_job_service.get_import_jobs(
         db=db,
         vendor=vendor,