fix: correct tojson|safe usage in templates and update validator

- Remove |safe from |tojson in HTML attributes (x-data) - quotes must
  become " for browsers to parse correctly
- Update LANG-002 and LANG-003 architecture rules to document correct
  |tojson usage patterns:
  - HTML attributes: |tojson (no |safe)
  - Script blocks: |tojson|safe
- Fix validator to warn when |tojson|safe is used in x-data (breaks
  HTML attribute parsing)
- Improve code quality across services, APIs, and tests

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

tests/unit/middleware/test_vendor_context.py

@@ -790,10 +790,11 @@ class TestVendorContextMiddleware:
 
         call_next = AsyncMock(return_value=Mock())
 
-        with patch.object(
-            VendorContextManager, "is_admin_request", return_value=False
-        ), patch.object(
-            VendorContextManager, "is_static_file_request", return_value=False
+        with (
+            patch.object(VendorContextManager, "is_admin_request", return_value=False),
+            patch.object(
+                VendorContextManager, "is_static_file_request", return_value=False
+            ),
         ):
             await middleware.dispatch(request, call_next)
 
@@ -836,9 +837,7 @@ class TestVendorContextMiddleware:
         mock_db = MagicMock()
 
         with (
-            patch.object(
-                VendorContextManager, "is_admin_request", return_value=False
-            ),
+            patch.object(VendorContextManager, "is_admin_request", return_value=False),
             patch.object(
                 VendorContextManager, "is_static_file_request", return_value=False
             ),
@@ -889,9 +888,7 @@ class TestVendorContextMiddleware:
         mock_db = MagicMock()
 
         with (
-            patch.object(
-                VendorContextManager, "is_admin_request", return_value=False
-            ),
+            patch.object(VendorContextManager, "is_admin_request", return_value=False),
             patch.object(
                 VendorContextManager, "is_static_file_request", return_value=False
             ),
@@ -928,9 +925,7 @@ class TestVendorContextMiddleware:
         call_next = AsyncMock(return_value=Mock())
 
         with (
-            patch.object(
-                VendorContextManager, "is_admin_request", return_value=False
-            ),
+            patch.object(VendorContextManager, "is_admin_request", return_value=False),
             patch.object(
                 VendorContextManager, "is_static_file_request", return_value=False
             ),