fix: validate risk_level in update_vendor_risk to prevent mixed-case values

[Jean-Regis-M]

Summary

Fixes #182 by adding input validation to update_vendor_risk so that only exactly "low", "medium", or "high" are accepted.

Problem

Currently, update_vendor_risk accepts any string as risk_level and stores it without validation. This allows mixed‑case values like "Medium" to be saved. Downstream logic that compares risk_level == "medium" fails because the stored value is "Medium", breaking fraud assessment and risk escalation.

Root Cause

The function lacks input validation. The risk_level parameter is passed directly to the repository without checking against the allowed set defined in the docstring. This is a validation gap.

Solution

Add a membership check at the start of the function:

• Define VALID_RISK_LEVELS = {"low", "medium", "high"}
• If risk_level is not in the set, raise ValueError with a clear message.

This ensures only the documented values are persisted, and any deviation fails fast.

Impact

• No breaking changes: all valid calls continue to work.
• Minimal diff: only 4 lines added.
• Improved correctness: invalid inputs are rejected instead of silently corrupting data.
• Prevents future bugs where case variations cause logic errors.

Testing

• Verified with the existing unit test (test_fraud_upd_013_mixed_case_risk_level_accepted_without_validation) which now passes.
• Manually tested with:
  • "medium" → succeeds
  • "Medium" → raises ValueError
  • "MEDIUM" → raises ValueError
  • "" → raises ValueError
  • None → raises ValueError
  • 123 → raises ValueError

Checklist

• Change is minimal and isolated
• Backward compatible
• Follows existing error handling pattern (ValueError)
• No side effects