fix: remove trailing slash from GET/POST routes to prevent 307→403 redirect

FastAPI's redirect_slashes=True causes GET /api/v1/canvas to 307 redirect
to /api/v1/canvas/ — axios follows the redirect but drops the Authorization
header, resulting in 403. Fixed by declaring routes as empty string instead
of '/' so no redirect is issued. Same fix applied to nodes and edges routes.
Updated all tests to use paths without trailing slashes.

backend/app/api/routes/nodes.py

@@ -10,13 +10,13 @@ from app.schemas.nodes import NodeCreate, NodeResponse, NodeUpdate
 router = APIRouter()
 
 
-@router.get("/", response_model=list[NodeResponse])
+@router.get("", response_model=list[NodeResponse])
 async def list_nodes(db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)):
     result = await db.execute(select(Node))
     return result.scalars().all()
 
 
-@router.post("/", response_model=NodeResponse, status_code=status.HTTP_201_CREATED)
+@router.post("", response_model=NodeResponse, status_code=status.HTTP_201_CREATED)
 async def create_node(body: NodeCreate, db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)):
     node = Node(**body.model_dump())
     db.add(node)