fix: correct tojson|safe usage in templates and update validator

- Remove |safe from |tojson in HTML attributes (x-data) - quotes must
  become " for browsers to parse correctly
- Update LANG-002 and LANG-003 architecture rules to document correct
  |tojson usage patterns:
  - HTML attributes: |tojson (no |safe)
  - Script blocks: |tojson|safe
- Fix validator to warn when |tojson|safe is used in x-data (breaks
  HTML attribute parsing)
- Improve code quality across services, APIs, and tests

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

tests/fixtures/auth_fixtures.py

@@ -5,6 +5,7 @@ Authentication-related test fixtures.
 Note: Fixtures should NOT use db.expunge() as it breaks lazy loading.
 See tests/conftest.py for details on fixture best practices.
 """
+
 import uuid
 
 import pytest
@@ -140,7 +141,10 @@ def vendor_user_headers(client, test_vendor_user, test_vendor_with_vendor_user):
     """
     response = client.post(
         "/api/v1/vendor/auth/login",
-        json={"email_or_username": test_vendor_user.username, "password": "vendorpass123"},
+        json={
+            "email_or_username": test_vendor_user.username,
+            "password": "vendorpass123",
+        },
     )
     assert response.status_code == 200, f"Vendor login failed: {response.text}"
     token = response.json()["access_token"]

tests/fixtures/customer_fixtures.py

@@ -5,6 +5,7 @@ Customer-related test fixtures.
 Note: Fixtures should NOT use db.expunge() as it breaks lazy loading.
 See tests/conftest.py for details on fixture best practices.
 """
+
 import pytest
 
 from models.database.customer import Customer, CustomerAddress

tests/fixtures/marketplace_import_job_fixtures.py

@@ -5,6 +5,7 @@ Marketplace import job test fixtures.
 Note: Fixtures should NOT use db.expunge() as it breaks lazy loading.
 See tests/conftest.py for details on fixture best practices.
 """
+
 import pytest
 
 from models.database.marketplace_import_job import MarketplaceImportJob

tests/fixtures/marketplace_product_fixtures.py

@@ -8,12 +8,15 @@ we create the translation alongside the marketplace product.
 Fixtures should NOT use db.expunge() as it breaks lazy loading.
 See tests/conftest.py for details on fixture best practices.
 """
+
 import uuid
 
 import pytest
 
 from models.database.marketplace_product import MarketplaceProduct
-from models.database.marketplace_product_translation import MarketplaceProductTranslation
+from models.database.marketplace_product_translation import (
+    MarketplaceProductTranslation,
+)
 
 
 def _create_marketplace_product_with_translation(

tests/fixtures/vendor_fixtures.py

@@ -5,6 +5,7 @@ Vendor-related test fixtures.
 Note: Fixtures should NOT use db.expunge() as it breaks lazy loading.
 See tests/conftest.py for details on fixture best practices.
 """
+
 import uuid
 
 import pytest