Vendor filters using field names and operator:value strings.

• Fields: id, code, name, status, tier, vendor_type, owner_id, contact_name,
  created_at, updated_at, tags (or tag), risk_score and search.
• Status, tier and vendor_type accept client display names with eq, neq or in.
  Names are case-insensitive; tiers must be enabled.
• Tags and risk_score support eq or in. Use tag names and risk labels;
  numeric band inputs are not accepted. Not set matches vendors without a score.
• owner_id uses the client user's ID.
• Other fields support eq, in, cont, like, gte, lte, gt, lt or neq where applicable.