fix: correct tojson|safe usage in templates and update validator

- Remove |safe from |tojson in HTML attributes (x-data) - quotes must
  become " for browsers to parse correctly
- Update LANG-002 and LANG-003 architecture rules to document correct
  |tojson usage patterns:
  - HTML attributes: |tojson (no |safe)
  - Script blocks: |tojson|safe
- Fix validator to warn when |tojson|safe is used in x-data (breaks
  HTML attribute parsing)
- Improve code quality across services, APIs, and tests

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/api/v1/vendor/inventory.py

@@ -5,6 +5,7 @@ Vendor inventory management endpoints.
 Vendor Context: Uses token_vendor_id from JWT token (authenticated vendor API pattern).
 The get_current_vendor_api dependency guarantees token_vendor_id is present.
 """
+
 import logging
 
 from fastapi import APIRouter, Depends, Query
@@ -36,7 +37,9 @@ def set_inventory(
     db: Session = Depends(get_db),
 ):
     """Set exact inventory quantity (replaces existing)."""
-    result = inventory_service.set_inventory(db, current_user.token_vendor_id, inventory)
+    result = inventory_service.set_inventory(
+        db, current_user.token_vendor_id, inventory
+    )
     db.commit()
     return result
 
@@ -48,7 +51,9 @@ def adjust_inventory(
     db: Session = Depends(get_db),
 ):
     """Adjust inventory (positive to add, negative to remove)."""
-    result = inventory_service.adjust_inventory(db, current_user.token_vendor_id, adjustment)
+    result = inventory_service.adjust_inventory(
+        db, current_user.token_vendor_id, adjustment
+    )
     db.commit()
     return result
 
@@ -60,7 +65,9 @@ def reserve_inventory(
     db: Session = Depends(get_db),
 ):
     """Reserve inventory for an order."""
-    result = inventory_service.reserve_inventory(db, current_user.token_vendor_id, reservation)
+    result = inventory_service.reserve_inventory(
+        db, current_user.token_vendor_id, reservation
+    )
     db.commit()
     return result
 
@@ -72,7 +79,9 @@ def release_reservation(
     db: Session = Depends(get_db),
 ):
     """Release reserved inventory (cancel order)."""
-    result = inventory_service.release_reservation(db, current_user.token_vendor_id, reservation)
+    result = inventory_service.release_reservation(
+        db, current_user.token_vendor_id, reservation
+    )
     db.commit()
     return result
 
@@ -84,7 +93,9 @@ def fulfill_reservation(
     db: Session = Depends(get_db),
 ):
     """Fulfill reservation (complete order, remove from stock)."""
-    result = inventory_service.fulfill_reservation(db, current_user.token_vendor_id, reservation)
+    result = inventory_service.fulfill_reservation(
+        db, current_user.token_vendor_id, reservation
+    )
     db.commit()
     return result
 
@@ -96,7 +107,9 @@ def get_product_inventory(
     db: Session = Depends(get_db),
 ):
     """Get inventory summary for a product."""
-    return inventory_service.get_product_inventory(db, current_user.token_vendor_id, product_id)
+    return inventory_service.get_product_inventory(
+        db, current_user.token_vendor_id, product_id
+    )
 
 
 @router.get("/inventory", response_model=InventoryListResponse)