fix: correct tojson|safe usage in templates and update validator

- Remove |safe from |tojson in HTML attributes (x-data) - quotes must
  become " for browsers to parse correctly
- Update LANG-002 and LANG-003 architecture rules to document correct
  |tojson usage patterns:
  - HTML attributes: |tojson (no |safe)
  - Script blocks: |tojson|safe
- Fix validator to warn when |tojson|safe is used in x-data (breaks
  HTML attribute parsing)
- Improve code quality across services, APIs, and tests

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/api/v1/admin/vendors.py

@@ -318,7 +318,9 @@ def delete_vendor(
 @router.get("/{vendor_identifier}/export/letzshop")
 def export_vendor_products_letzshop(
     vendor_identifier: str = Path(..., description="Vendor ID or vendor_code"),
-    language: str = Query("en", description="Language for title/description (en, fr, de)"),
+    language: str = Query(
+        "en", description="Language for title/description (en, fr, de)"
+    ),
     include_inactive: bool = Query(False, description="Include inactive products"),
     db: Session = Depends(get_db),
     current_admin: User = Depends(get_current_admin_api),