fix: correct tojson|safe usage in templates and update validator

- Remove |safe from |tojson in HTML attributes (x-data) - quotes must
  become " for browsers to parse correctly
- Update LANG-002 and LANG-003 architecture rules to document correct
  |tojson usage patterns:
  - HTML attributes: |tojson (no |safe)
  - Script blocks: |tojson|safe
- Fix validator to warn when |tojson|safe is used in x-data (breaks
  HTML attribute parsing)
- Improve code quality across services, APIs, and tests

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/exceptions/handler.py

@@ -366,11 +366,11 @@ def _redirect_to_login(request: Request) -> RedirectResponse:
     if context_type == RequestContext.VENDOR_DASHBOARD:
         # Extract vendor code from the request path
         # Path format: /vendor/{vendor_code}/...
-        path_parts = request.url.path.split('/')
+        path_parts = request.url.path.split("/")
         vendor_code = None
 
         # Find vendor code in path
-        if len(path_parts) >= 3 and path_parts[1] == 'vendor':
+        if len(path_parts) >= 3 and path_parts[1] == "vendor":
             vendor_code = path_parts[2]
 
         # Fallback: try to get from request state