fix: correct tojson|safe usage in templates and update validator

- Remove |safe from |tojson in HTML attributes (x-data) - quotes must
  become " for browsers to parse correctly
- Update LANG-002 and LANG-003 architecture rules to document correct
  |tojson usage patterns:
  - HTML attributes: |tojson (no |safe)
  - Script blocks: |tojson|safe
- Fix validator to warn when |tojson|safe is used in x-data (breaks
  HTML attribute parsing)
- Improve code quality across services, APIs, and tests

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/services/admin_service.py

@@ -35,7 +35,7 @@ from middleware.auth import AuthManager
 from models.database.company import Company
 from models.database.marketplace_import_job import MarketplaceImportJob
 from models.database.user import User
-from models.database.vendor import Role, Vendor, VendorUser
+from models.database.vendor import Role, Vendor
 from models.schema.marketplace_import_job import MarketplaceImportJobResponse
 from models.schema.vendor import VendorCreate
 
@@ -143,7 +143,9 @@ class AdminService:
 
         # Apply pagination
         skip = (page - 1) * per_page
-        users = query.order_by(User.created_at.desc()).offset(skip).limit(per_page).all()
+        users = (
+            query.order_by(User.created_at.desc()).offset(skip).limit(per_page).all()
+        )
 
         return users, total, pages
 
@@ -199,7 +201,9 @@ class AdminService:
         """
         user = (
             db.query(User)
-            .options(joinedload(User.owned_companies), joinedload(User.vendor_memberships))
+            .options(
+                joinedload(User.owned_companies), joinedload(User.vendor_memberships)
+            )
             .filter(User.id == user_id)
             .first()
         )
@@ -243,12 +247,16 @@ class AdminService:
         # Check email uniqueness if changing
         if email and email != user.email:
             if db.query(User).filter(User.email == email).first():
-                raise UserAlreadyExistsException("Email already registered", field="email")
+                raise UserAlreadyExistsException(
+                    "Email already registered", field="email"
+                )
 
         # Check username uniqueness if changing
         if username and username != user.username:
             if db.query(User).filter(User.username == username).first():
-                raise UserAlreadyExistsException("Username already taken", field="username")
+                raise UserAlreadyExistsException(
+                    "Username already taken", field="username"
+                )
 
         # Update fields
         if email is not None:
@@ -322,7 +330,9 @@ class AdminService:
         search_term = f"%{query.lower()}%"
         users = (
             db.query(User)
-            .filter(or_(User.username.ilike(search_term), User.email.ilike(search_term)))
+            .filter(
+                or_(User.username.ilike(search_term), User.email.ilike(search_term))
+            )
             .limit(limit)
             .all()
         )
@@ -360,14 +370,20 @@ class AdminService:
         """
         try:
             # Validate company exists
-            company = db.query(Company).filter(Company.id == vendor_data.company_id).first()
+            company = (
+                db.query(Company).filter(Company.id == vendor_data.company_id).first()
+            )
             if not company:
-                raise ValidationException(f"Company with ID {vendor_data.company_id} not found")
+                raise ValidationException(
+                    f"Company with ID {vendor_data.company_id} not found"
+                )
 
             # Check if vendor code already exists
             existing_vendor = (
                 db.query(Vendor)
-                .filter(func.upper(Vendor.vendor_code) == vendor_data.vendor_code.upper())
+                .filter(
+                    func.upper(Vendor.vendor_code) == vendor_data.vendor_code.upper()
+                )
                 .first()
             )
             if existing_vendor:
@@ -613,7 +629,13 @@ class AdminService:
                 update_data["tax_number"] = None
 
             # Convert empty strings to None for contact fields (empty = inherit)
-            contact_fields = ["contact_email", "contact_phone", "website", "business_address", "tax_number"]
+            contact_fields = [
+                "contact_email",
+                "contact_phone",
+                "website",
+                "business_address",
+                "tax_number",
+            ]
             for field in contact_fields:
                 if field in update_data and update_data[field] == "":
                     update_data[field] = None