fix: remove trailing slash from GET/POST routes to prevent 307→403 redirect

FastAPI's redirect_slashes=True causes GET /api/v1/canvas to 307 redirect
to /api/v1/canvas/ — axios follows the redirect but drops the Authorization
header, resulting in 403. Fixed by declaring routes as empty string instead
of '/' so no redirect is issued. Same fix applied to nodes and edges routes.
Updated all tests to use paths without trailing slashes.

backend/app/api/routes/canvas.py

@@ -12,7 +12,7 @@ from app.schemas.canvas import CanvasSaveRequest, CanvasStateResponse
 router = APIRouter()
 
 
-@router.get("/", response_model=CanvasStateResponse)
+@router.get("", response_model=CanvasStateResponse)
 async def load_canvas(db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)):
     nodes = (await db.execute(select(Node))).scalars().all()
     edges = (await db.execute(select(Edge))).scalars().all()