fix: extend architecture validation to vendor/shared JS files

- Include static/vendor/js and static/shared/js in JS validation
- Fix onboarding.js: use apiClient (not window.apiClient), use logger
- Fix onboarding.js: use relative paths (not /api/v1/ prefix)
- Add noqa comments for standalone pages (login, onboarding)
- Add ...data() to messages.js for layout inheritance

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

static/vendor/js/login.js

@@ -1,4 +1,6 @@
 // app/static/vendor/js/login.js
+// noqa: js-003 - Standalone login page without vendor layout
+// noqa: js-004 - Standalone page has no currentPage sidebar highlight
 /**
  * Vendor login page logic
  */