Register the endpoints list without a trailing slash, and stop hiding its errors

An endpoint reported telemetry correctly for hours while the Fleet page showed
"No endpoints found". The PC detail page displayed its panels the whole time, so
ingest was plainly working; only the list was empty.

The list route was the one route in 331 paths registered with a trailing slash:

    @endpoints_bp.route('/', methods=['GET'])      ->  /api/endpoints/

The browser client calls it without one, so Flask answered a 308 redirect to an
ABSOLUTE url. On dev that resolves and nobody notices. Behind the IIS subpath it
cannot: with no ProxyFix, Werkzeug builds that Location from the scheme and host
it believes it has, so it emitted http:// and dropped the /shopdb prefix. A
browser will not follow an https page to http, the request failed, and the
page's catch block rendered the empty state.

Every other route in the plugin worked throughout, because none of them carries
a trailing slash - the detail panels call /endpoints/asset/<id>/status and were
never redirected. Detail works, list empty is the signature of this bug.

Registered as '' now, so the rule is /api/endpoints. That is what
CONTRIBUTING.md's API section spells and what every other list route in the
product already did. The inventory and the generated spec are updated to match.

Also here:

  - tests/test_core/test_no_redirecting_routes.py fails the build if any /api
    rule is registered with a trailing slash and strict slashes. Verified by
    planting the violation: it named the offending route, then passed once
    reverted. It takes the shared app fixture rather than building its own
    application - doing that rebinds SQLAlchemy and leaves the NEXT module
    without tables, which showed up as three unrelated "no such table: settings"
    failures visible only in a full run.

  - The Fleet page now renders "Could not load endpoints (HTTP nnn). This is a
    failed request, not an empty fleet." A list that reports a 403 and an empty
    fleet identically is what made this take as long as it did.

  - TRUSTED_PROXY_COUNT (default 0) applies ProxyFix when set. Off by default on
    purpose: it makes X-Forwarded-* trusted, and a client can send those itself,
    while the login rate limit and account lockout are keyed on the client
    address. Set it to 1 on an instance behind IIS.

Full suite 2124 passed, vitest 260 passed, naming and docs gates green.

plugins/endpoints/api/routes.py

@@ -55,11 +55,25 @@ def _format_uptime(seconds):
 # Endpoint state
 # =============================================================================
 
-@endpoints_bp.route('/', methods=['GET'])
+@endpoints_bp.route('', methods=['GET'])
 @require_permission('endpoints.view')
 def list_endpoints():
     """List reported endpoint states.
 
+    Registered as '' so the rule is '/api/endpoints', with no trailing slash.
+    CONTRIBUTING.md's API section spells endpoints that way ('/api/machines'),
+    and every other plugin's list route follows it - this was the only route in
+    331 paths that did not.
+
+    It was not cosmetic. A rule ending in a slash makes Flask answer the
+    unslashed URL with a 308 to an ABSOLUTE url. On dev that resolves and
+    nobody notices. Behind the IIS subpath it does not: with no ProxyFix,
+    Werkzeug builds that Location from the scheme and host it believes it has,
+    so it emitted http:// and dropped the /shopdb prefix. The browser refuses
+    to follow an https page to http, the list request failed, and the page
+    rendered "No endpoints found" - indistinguishable from a fleet with nothing
+    in it. The agent had been reporting correctly the whole time.
+
     Joins through Computer so each row carries computerid and can deep-link
     into the existing PC detail page (/pcs/{computerid}). Endpoint state only
     exists for hostnames resolved to a Computer, so the join is not lossy.