fix: remove trailing slash from GET/POST routes to prevent 307→403 redirect

FastAPI's redirect_slashes=True causes GET /api/v1/canvas to 307 redirect
to /api/v1/canvas/ — axios follows the redirect but drops the Authorization
header, resulting in 403. Fixed by declaring routes as empty string instead
of '/' so no redirect is issued. Same fix applied to nodes and edges routes.
Updated all tests to use paths without trailing slashes.

backend/app/api/routes/canvas.py

@@ -12,7 +12,7 @@ from app.schemas.canvas import CanvasSaveRequest, CanvasStateResponse
 router = APIRouter()
 
 
-@router.get("/", response_model=CanvasStateResponse)
+@router.get("", response_model=CanvasStateResponse)
 async def load_canvas(db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)):
     nodes = (await db.execute(select(Node))).scalars().all()
     edges = (await db.execute(select(Edge))).scalars().all()

backend/app/api/routes/edges.py

@@ -10,13 +10,13 @@ from app.schemas.edges import EdgeCreate, EdgeResponse, EdgeUpdate
 router = APIRouter()
 
 
-@router.get("/", response_model=list[EdgeResponse])
+@router.get("", response_model=list[EdgeResponse])
 async def list_edges(db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)):
     result = await db.execute(select(Edge))
     return result.scalars().all()
 
 
-@router.post("/", response_model=EdgeResponse, status_code=status.HTTP_201_CREATED)
+@router.post("", response_model=EdgeResponse, status_code=status.HTTP_201_CREATED)
 async def create_edge(body: EdgeCreate, db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)):
     edge = Edge(**body.model_dump())
     db.add(edge)

backend/app/api/routes/nodes.py

@@ -10,13 +10,13 @@ from app.schemas.nodes import NodeCreate, NodeResponse, NodeUpdate
 router = APIRouter()
 
 
-@router.get("/", response_model=list[NodeResponse])
+@router.get("", response_model=list[NodeResponse])
 async def list_nodes(db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)):
     result = await db.execute(select(Node))
     return result.scalars().all()
 
 
-@router.post("/", response_model=NodeResponse, status_code=status.HTTP_201_CREATED)
+@router.post("", response_model=NodeResponse, status_code=status.HTTP_201_CREATED)
 async def create_node(body: NodeCreate, db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)):
     node = Node(**body.model_dump())
     db.add(node)