fix: correct tojson|safe usage in templates and update validator

- Remove |safe from |tojson in HTML attributes (x-data) - quotes must
  become " for browsers to parse correctly
- Update LANG-002 and LANG-003 architecture rules to document correct
  |tojson usage patterns:
  - HTML attributes: |tojson (no |safe)
  - Script blocks: |tojson|safe
- Fix validator to warn when |tojson|safe is used in x-data (breaks
  HTML attribute parsing)
- Improve code quality across services, APIs, and tests

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/routes/admin_pages.py

@@ -408,9 +408,7 @@ async def admin_user_create_page(
     )
 
 
-@router.get(
-    "/users/{user_id}", response_class=HTMLResponse, include_in_schema=False
-)
+@router.get("/users/{user_id}", response_class=HTMLResponse, include_in_schema=False)
 async def admin_user_detail_page(
     request: Request,
     user_id: int = Path(..., description="User ID"),
@@ -562,7 +560,9 @@ async def admin_letzshop_page(
 # ============================================================================
 
 
-@router.get("/marketplace-products", response_class=HTMLResponse, include_in_schema=False)
+@router.get(
+    "/marketplace-products", response_class=HTMLResponse, include_in_schema=False
+)
 async def admin_marketplace_products_page(
     request: Request,
     current_user: User = Depends(get_current_admin_from_cookie_or_header),