fix(c2): append trailing slash to mythic /graphql URL to avoid 301 redirect

Nginx fronting Mythic 3.x redirects /graphql → /graphql/ (HTTP 301).
The sprint 8 SSRF defense (allow_redirects=False) is correct and intentional;
the fix is the URL, not the redirect policy. Upstream reference:
mythic_utilities.get_http_transport hardcodes /graphql/ with trailing slash.

Updated _GQL_URL in all three adapter test files to match.
Added TestMythicAdapterUrlConstruction regression test to prevent silent
regression on future refactors.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/test_c2_adapter_mythic.py

@@ -9,7 +9,7 @@ from backend.app.services.c2.adapter import C2Error
 from backend.app.services.c2.mythic import MythicAdapter
 
 _BASE_URL = "https://mythic.lab:7443"
-_GQL_URL = _BASE_URL + "/graphql"
+_GQL_URL = _BASE_URL + "/graphql/"
 _TOKEN = "fake-api-token"
 
 
@@ -143,9 +143,19 @@ class TestMythicAdapterNoRedirects:
         """Adapter must not follow HTTP redirects (allow_redirects=False)."""
         with rm_module.Mocker() as m:
             # Simulate a redirect response; requests-mock won't auto-follow it.
-            m.post(_GQL_URL, status_code=301, headers={"Location": "https://evil.example/graphql"})
+            m.post(_GQL_URL, status_code=301, headers={"Location": "https://evil.example/graphql/"})
             # With allow_redirects=False the 301 is treated as a non-2xx → raise_for_status raises.
             with pytest.raises(C2Error):
                 adapter.list_callbacks()
             # Exactly one request was made — no follow-up to Location.
             assert len(m.request_history) == 1
+
+
+class TestMythicAdapterUrlConstruction:
+    def test_mythic_adapter_url_has_trailing_slash(self):
+        a1 = MythicAdapter(url="https://x:7443", api_token="t")
+        assert a1._url == "https://x:7443/graphql/"
+        a2 = MythicAdapter(url="https://x:7443/", api_token="t")
+        assert a2._url == "https://x:7443/graphql/"
+        a3 = MythicAdapter(url="https://x:7443///", api_token="t")
+        assert a3._url == "https://x:7443/graphql/"