fix: correct tojson|safe usage in templates and update validator

- Remove |safe from |tojson in HTML attributes (x-data) - quotes must
  become " for browsers to parse correctly
- Update LANG-002 and LANG-003 architecture rules to document correct
  |tojson usage patterns:
  - HTML attributes: |tojson (no |safe)
  - Script blocks: |tojson|safe
- Fix validator to warn when |tojson|safe is used in x-data (breaks
  HTML attribute parsing)
- Improve code quality across services, APIs, and tests

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

scripts/seed_demo.py

@@ -30,7 +30,6 @@ Environment Variables:
 This script is idempotent when run normally.
 """
 
-import argparse
 import sys
 from datetime import UTC, datetime
 from decimal import Decimal
@@ -57,7 +56,9 @@ from models.database.company import Company
 from models.database.customer import Customer, CustomerAddress
 from models.database.marketplace_import_job import MarketplaceImportJob
 from models.database.marketplace_product import MarketplaceProduct
-from models.database.marketplace_product_translation import MarketplaceProductTranslation
+from models.database.marketplace_product_translation import (
+    MarketplaceProductTranslation,
+)
 from models.database.order import Order, OrderItem
 from models.database.product import Product
 from models.database.user import User
@@ -263,7 +264,9 @@ def reset_all_data(db: Session):
                 sys.exit(0)
         except EOFError:
             print_error("No interactive terminal available.")
-            print("  Use FORCE_RESET=true to skip confirmation in non-interactive mode.")
+            print(
+                "  Use FORCE_RESET=true to skip confirmation in non-interactive mode."
+            )
             sys.exit(1)
 
     # Delete in correct order (respecting foreign keys)
@@ -367,9 +370,7 @@ def create_demo_companies(db: Session, auth_manager: AuthManager) -> list[Compan
         db.flush()
 
         companies.append(company)
-        print_success(
-            f"Created company: {company.name} (Owner: {owner_user.email})"
-        )
+        print_success(f"Created company: {company.name} (Owner: {owner_user.email})")
 
     db.flush()
     return companies
@@ -456,7 +457,9 @@ def create_demo_vendors(
         if vendor_data.get("custom_domain"):
             domain = VendorDomain(
                 vendor_id=vendor.id,
-                domain=vendor_data["custom_domain"],  # ✅ Field is 'domain', not 'domain_name'
+                domain=vendor_data[
+                    "custom_domain"
+                ],  # ✅ Field is 'domain', not 'domain_name'
                 is_verified=True,  # Auto-verified for demo
                 is_primary=True,
                 verification_token=None,
@@ -695,7 +698,7 @@ def print_summary(db: Session):
         print(f"    Vendors:   {len(company.vendors) if company.vendors else 0}")
         print(f"    Status:    {'✓ Active' if company.is_active else '✗ Inactive'}")
         if company.is_verified:
-            print(f"    Verified:  ✓")
+            print("    Verified:  ✓")
 
     # Show vendor details
     vendors = db.query(Vendor).all()