fix: correct tojson|safe usage in templates and update validator

- Remove |safe from |tojson in HTML attributes (x-data) - quotes must
  become " for browsers to parse correctly
- Update LANG-002 and LANG-003 architecture rules to document correct
  |tojson usage patterns:
  - HTML attributes: |tojson (no |safe)
  - Script blocks: |tojson|safe
- Fix validator to warn when |tojson|safe is used in x-data (breaks
  HTML attribute parsing)
- Improve code quality across services, APIs, and tests

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/api/v1/vendor/analytics.py

@@ -39,7 +39,9 @@ def get_vendor_analytics(
         period=data["period"],
         start_date=data["start_date"],
         imports=VendorAnalyticsImports(count=data["imports"]["count"]),
-        catalog=VendorAnalyticsCatalog(products_added=data["catalog"]["products_added"]),
+        catalog=VendorAnalyticsCatalog(
+            products_added=data["catalog"]["products_added"]
+        ),
         inventory=VendorAnalyticsInventory(
             total_locations=data["inventory"]["total_locations"]
         ),