fix: correct tojson|safe usage in templates and update validator

- Remove |safe from |tojson in HTML attributes (x-data) - quotes must
  become " for browsers to parse correctly
- Update LANG-002 and LANG-003 architecture rules to document correct
  |tojson usage patterns:
  - HTML attributes: |tojson (no |safe)
  - Script blocks: |tojson|safe
- Fix validator to warn when |tojson|safe is used in x-data (breaks
  HTML attribute parsing)
- Improve code quality across services, APIs, and tests

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/services/letzshop/credentials_service.py

@@ -6,7 +6,7 @@ Handles secure storage and retrieval of per-vendor Letzshop API credentials.
 """
 
 import logging
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 
 from sqlalchemy.orm import Session
 
@@ -24,14 +24,10 @@ DEFAULT_ENDPOINT = "https://letzshop.lu/graphql"
 class CredentialsError(Exception):
     """Base exception for credentials errors."""
 
-    pass
-
 
 class CredentialsNotFoundError(CredentialsError):
     """Raised when credentials are not found for a vendor."""
 
-    pass
-
 
 class LetzshopCredentialsService:
     """
@@ -54,9 +50,7 @@ class LetzshopCredentialsService:
     # CRUD Operations
     # ========================================================================
 
-    def get_credentials(
-        self, vendor_id: int
-    ) -> VendorLetzshopCredentials | None:
+    def get_credentials(self, vendor_id: int) -> VendorLetzshopCredentials | None:
         """
         Get Letzshop credentials for a vendor.
 
@@ -72,9 +66,7 @@ class LetzshopCredentialsService:
             .first()
         )
 
-    def get_credentials_or_raise(
-        self, vendor_id: int
-    ) -> VendorLetzshopCredentials:
+    def get_credentials_or_raise(self, vendor_id: int) -> VendorLetzshopCredentials:
         """
         Get Letzshop credentials for a vendor or raise an exception.
 
@@ -293,9 +285,7 @@ class LetzshopCredentialsService:
     # Connection Testing
     # ========================================================================
 
-    def test_connection(
-        self, vendor_id: int
-    ) -> tuple[bool, float | None, str | None]:
+    def test_connection(self, vendor_id: int) -> tuple[bool, float | None, str | None]:
         """
         Test the connection for a vendor's credentials.
 
@@ -364,7 +354,7 @@ class LetzshopCredentialsService:
         if credentials is None:
             return None
 
-        credentials.last_sync_at = datetime.now(timezone.utc)
+        credentials.last_sync_at = datetime.now(UTC)
         credentials.last_sync_status = status
         credentials.last_sync_error = error