fix: correct tojson|safe usage in templates and update validator

- Remove |safe from |tojson in HTML attributes (x-data) - quotes must
  become " for browsers to parse correctly
- Update LANG-002 and LANG-003 architecture rules to document correct
  |tojson usage patterns:
  - HTML attributes: |tojson (no |safe)
  - Script blocks: |tojson|safe
- Fix validator to warn when |tojson|safe is used in x-data (breaks
  HTML attribute parsing)
- Improve code quality across services, APIs, and tests

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

tests/integration/middleware/test_context_detection_flow.py

@@ -127,7 +127,8 @@ class TestContextDetectionFlow:
         with patch("app.core.config.settings") as mock_settings:
             mock_settings.platform_domain = "platform.com"
             response = client.get(
-                "/api/test-admin-subdomain-context", headers={"host": "admin.platform.com"}
+                "/api/test-admin-subdomain-context",
+                headers={"host": "admin.platform.com"},
             )
 
         assert response.status_code == 200
@@ -289,7 +290,9 @@ class TestContextDetectionFlow:
 
         with patch("app.core.config.settings") as mock_settings:
             mock_settings.platform_domain = "platform.com"
-            response = client.get("/shop/test-custom-domain-shop", headers={"host": "customdomain.com"})
+            response = client.get(
+                "/shop/test-custom-domain-shop", headers={"host": "customdomain.com"}
+            )
 
         assert response.status_code == 200
         data = response.json()