fix: correct tojson|safe usage in templates and update validator

- Remove |safe from |tojson in HTML attributes (x-data) - quotes must
  become " for browsers to parse correctly
- Update LANG-002 and LANG-003 architecture rules to document correct
  |tojson usage patterns:
  - HTML attributes: |tojson (no |safe)
  - Script blocks: |tojson|safe
- Fix validator to warn when |tojson|safe is used in x-data (breaks
  HTML attribute parsing)
- Improve code quality across services, APIs, and tests

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/utils/data_processing.py

@@ -54,16 +54,18 @@ class GTINProcessor:
             # Standard lengths - return as-is (already valid)
             return gtin_clean
 
-        elif length > 14:
+        if length > 14:
             # Too long - truncate to EAN-13
             logger.debug(f"GTIN too long ({length} digits), truncating: {gtin_clean}")
             return gtin_clean[-13:]
 
-        elif 0 < length < 14:
+        if 0 < length < 14:
             # Non-standard length - pad to EAN-13 (European standard)
             # EAN-13 is the international standard used in Europe and most of the world
             # UPC-A (12 digits) is primarily US/Canada
-            logger.debug(f"GTIN non-standard ({length} digits), padding to EAN-13: {gtin_clean}")
+            logger.debug(
+                f"GTIN non-standard ({length} digits), padding to EAN-13: {gtin_clean}"
+            )
             return gtin_clean.zfill(13)
 
         logger.warning(f"Invalid GTIN format: '{gtin_value}'")