fix: remove trailing slash from GET/POST routes to prevent 307→403 redirect

FastAPI's redirect_slashes=True causes GET /api/v1/canvas to 307 redirect
to /api/v1/canvas/ — axios follows the redirect but drops the Authorization
header, resulting in 403. Fixed by declaring routes as empty string instead
of '/' so no redirect is issued. Same fix applied to nodes and edges routes.
Updated all tests to use paths without trailing slashes.

backend/tests/test_auth.py

@@ -29,7 +29,7 @@ async def test_login_wrong_username(client: AsyncClient, mock_credentials):
 
 
 async def test_protected_route_requires_auth(client: AsyncClient):
-    res = await client.get("/api/v1/nodes/")
+    res = await client.get("/api/v1/nodes")
     assert res.status_code == 403