fix: correct tojson|safe usage in templates and update validator

- Remove |safe from |tojson in HTML attributes (x-data) - quotes must
  become " for browsers to parse correctly
- Update LANG-002 and LANG-003 architecture rules to document correct
  |tojson usage patterns:
  - HTML attributes: |tojson (no |safe)
  - Script blocks: |tojson|safe
- Fix validator to warn when |tojson|safe is used in x-data (breaks
  HTML attribute parsing)
- Improve code quality across services, APIs, and tests

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

tests/unit/services/test_vendor_service.py

@@ -1,5 +1,6 @@
 # tests/unit/services/test_vendor_service.py
 """Unit tests for VendorService following the application's exception patterns."""
+
 import uuid
 
 import pytest
@@ -85,7 +86,9 @@ class TestVendorService:
 
         assert vendor.is_verified is True  # Admin creates verified vendor
 
-    def test_create_vendor_duplicate_code(self, db, test_user, test_company, test_vendor):
+    def test_create_vendor_duplicate_code(
+        self, db, test_user, test_company, test_vendor
+    ):
         """Test vendor creation fails with duplicate vendor code."""
         vendor_data = VendorCreate(
             company_id=test_company.id,
@@ -359,9 +362,11 @@ class TestVendorService:
 
         # Re-query objects to avoid session issues
         vendor = db.query(Vendor).filter(Vendor.id == test_vendor.id).first()
-        mp = db.query(MarketplaceProduct).filter(
-            MarketplaceProduct.id == unique_product.id
-        ).first()
+        mp = (
+            db.query(MarketplaceProduct)
+            .filter(MarketplaceProduct.id == unique_product.id)
+            .first()
+        )
 
         product_data = ProductCreate(
             marketplace_product_id=mp.id,
@@ -394,6 +399,7 @@ class TestVendorService:
         """Test adding product that's already in vendor fails."""
         # Re-query to get fresh instances
         from models.database.product import Product
+
         vendor = db.query(Vendor).filter(Vendor.id == test_vendor.id).first()
         product = db.query(Product).filter(Product.id == test_product.id).first()
 
@@ -469,7 +475,9 @@ class TestVendorServiceExceptionDetails:
     def setup_method(self):
         self.service = VendorService()
 
-    def test_exception_to_dict_structure(self, db, test_user, test_vendor, test_company):
+    def test_exception_to_dict_structure(
+        self, db, test_user, test_vendor, test_company
+    ):
         """Test that exceptions can be properly serialized to dict for API responses."""
         vendor_data = VendorCreate(
             company_id=test_company.id,