fix: upgrade fastapi to 0.135.1, fix starlette CVEs, update auth test assertions

- fastapi 0.115.0 → 0.135.1 pulls starlette 0.52.1 (fixes CVE-2024-47874, CVE-2025-54121)
- pip-audit: ignore CVE-2024-23342 (ecdsa Minerva attack, no fix exists; app uses HS256 only)
- Update auth guard tests: FastAPI 0.135 returns 401 (not 403) when Bearer token is missing

backend/tests/test_canvas.py

@@ -35,7 +35,7 @@ async def test_load_canvas_empty(client: AsyncClient, headers: dict):
 
 async def test_load_canvas_requires_auth(client: AsyncClient):
     res = await client.get("/api/v1/canvas")
-    assert res.status_code == 403
+    assert res.status_code == 401
 
 
 # ── save_canvas ───────────────────────────────────────────────────────────────
@@ -122,4 +122,4 @@ async def test_save_canvas_persists_edge_custom_color_and_path_style(client: Asy
 
 async def test_save_canvas_requires_auth(client: AsyncClient):
     res = await client.post("/api/v1/canvas/save", json={"nodes": [], "edges": [], "viewport": {}})
-    assert res.status_code == 403
+    assert res.status_code == 401