fix: extend architecture validation to vendor/shared JS files

- Include static/vendor/js and static/shared/js in JS validation
- Fix onboarding.js: use apiClient (not window.apiClient), use logger
- Fix onboarding.js: use relative paths (not /api/v1/ prefix)
- Add noqa comments for standalone pages (login, onboarding)
- Add ...data() to messages.js for layout inheritance

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

static/vendor/js/messages.js

@@ -15,6 +15,8 @@ const messagesLog = window.LogConfig?.createLogger('VENDOR-MESSAGES') || console
  */
 function vendorMessages(initialConversationId = null) {
     return {
+        ...data(),
+
         // Loading states
         loading: true,
         loadingConversations: false,