fix: correct tojson|safe usage in templates and update validator

- Remove |safe from |tojson in HTML attributes (x-data) - quotes must
  become " for browsers to parse correctly
- Update LANG-002 and LANG-003 architecture rules to document correct
  |tojson usage patterns:
  - HTML attributes: |tojson (no |safe)
  - Script blocks: |tojson|safe
- Fix validator to warn when |tojson|safe is used in x-data (breaks
  HTML attribute parsing)
- Improve code quality across services, APIs, and tests

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/api/deps.py

@@ -45,7 +45,6 @@ from app.exceptions import (
     InsufficientVendorPermissionsException,
     InvalidTokenException,
     UnauthorizedVendorAccessException,
-    VendorAccessDeniedException,
     VendorNotFoundException,
     VendorOwnerOnlyException,
 )
@@ -306,15 +305,15 @@ def get_current_vendor_api(
 
     # Require vendor context in token
     if not hasattr(user, "token_vendor_id"):
-        raise InvalidTokenException("Token missing vendor information. Please login again.")
+        raise InvalidTokenException(
+            "Token missing vendor information. Please login again."
+        )
 
     vendor_id = user.token_vendor_id
 
     # Verify user still has access to this vendor
     if not user.is_member_of(vendor_id):
-        logger.warning(
-            f"User {user.username} lost access to vendor_id={vendor_id}"
-        )
+        logger.warning(f"User {user.username} lost access to vendor_id={vendor_id}")
         raise InsufficientPermissionsException(
             "Access to vendor has been revoked. Please login again."
         )
@@ -605,7 +604,9 @@ def require_vendor_permission(permission: str):
     ) -> User:
         # Get vendor ID from JWT token
         if not hasattr(current_user, "token_vendor_id"):
-            raise InvalidTokenException("Token missing vendor information. Please login again.")
+            raise InvalidTokenException(
+                "Token missing vendor information. Please login again."
+            )
 
         vendor_id = current_user.token_vendor_id
 
@@ -649,7 +650,9 @@ def require_vendor_owner(
     """
     # Get vendor ID from JWT token
     if not hasattr(current_user, "token_vendor_id"):
-        raise InvalidTokenException("Token missing vendor information. Please login again.")
+        raise InvalidTokenException(
+            "Token missing vendor information. Please login again."
+        )
 
     vendor_id = current_user.token_vendor_id
 
@@ -695,7 +698,9 @@ def require_any_vendor_permission(*permissions: str):
     ) -> User:
         # Get vendor ID from JWT token
         if not hasattr(current_user, "token_vendor_id"):
-            raise InvalidTokenException("Token missing vendor information. Please login again.")
+            raise InvalidTokenException(
+                "Token missing vendor information. Please login again."
+            )
 
         vendor_id = current_user.token_vendor_id
 
@@ -748,7 +753,9 @@ def require_all_vendor_permissions(*permissions: str):
     ) -> User:
         # Get vendor ID from JWT token
         if not hasattr(current_user, "token_vendor_id"):
-            raise InvalidTokenException("Token missing vendor information. Please login again.")
+            raise InvalidTokenException(
+                "Token missing vendor information. Please login again."
+            )
 
         vendor_id = current_user.token_vendor_id