Add explicit root-node flag to tree API to prevent parentless non-root nodes

[grantfitzsimmons]

Currently the tree import API allows omitting the parent reference so the root node can be created. That leads to an unsafe condition where non-root tree nodes can also be created without a parent. Once such nodes exist, Specify can behave incorrectly: invalid rank labels, child counts stuck at zero, search/indexing issues for storage nodes, and failures during tree operations like move.

This is opened in response to a user creating a tree using the API without parents, which should not be possible as the interface and WorkBench already prevent this from occurring.

Problem

• The API currently uses the same parent-omitted behavior for root creation and invalid non-root imports.
• Non-root nodes without parents are not valid in Specify, but the API does not explicitly prevent them.
• This causes data integrity problems that are hard to recover from with existing repair tools.

Suggested prevention

• Introduce an explicit is_root or root_node flag on tree creation API requests.
• Require parent references for all nodes unless is_root=true.
• Validate that only one root node is created per tree definition.
• Reject import requests where a non-root node is missing a parent instead of silently accepting invalid tree state.

Benefits

• Makes the API contract explicit and safer.
• Prevents accidental creation of invalid parentless nodes.
• Avoids downstream tree inconsistencies and runtime errors.
• Keeps root creation behavior intact without weakening parent validation for all child nodes.

Example

API semantics could become:

• parent_id required for all nodes by default
• root: true allowed only for the first/root node
• any node with root: false or omitted root flag must include parent_id

This ensures root creation is still possible, while protecting users from importing broken tree structures.