fix(cache): 存量空/url 策略规范为 all，避免静默收窄

评审修复：enabled 且 policy 为空或 url 时，写入/展示/快照/渲染均映射为 all，
保证旧站点宽缓存范围不变；新建 UI 仍显式提交 static 作为推荐默认。

pkg/render/openresty/render.go

@@ -497,13 +497,16 @@ func renderRouteCachePolicyCondition(cacheConfig routeCacheConfig) string {
 	}
 }
 
+// normalizeRenderCachePolicy maps stored policy for OpenResty generation.
+// Legacy empty and "url" mean "all GETs after security bypass" (pre-static default).
+// Explicit "static" uses the built-in extension allowlist. Unknown policies fall back to static.
 func normalizeRenderCachePolicy(raw string) string {
 	policy := strings.TrimSpace(strings.ToLower(raw))
 	switch policy {
-	case "", cachePolicyStatic:
-		return cachePolicyStatic
-	case cachePolicyURL, cachePolicyAll:
+	case "", cachePolicyURL, cachePolicyAll:
 		return cachePolicyAll
+	case cachePolicyStatic:
+		return cachePolicyStatic
 	case cachePolicySuffix, cachePolicyPathPrefix, cachePolicyPathExact:
 		return policy
 	default:

pkg/render/openresty/render_test.go

@@ -411,9 +411,10 @@ func TestRenderRouteCachePolicyConditionStaticDefault(t *testing.T) {
 		t.Fatalf("static policy must not include html, got:\n%s", staticBlock)
 	}
 
+	// Legacy empty/url = all (wide cache after security bypass).
 	emptyPolicy := renderRouteCachePolicyCondition(routeCacheConfig{Enabled: true, Policy: ""})
-	if emptyPolicy == "" {
-		t.Fatal("empty policy should default to static condition")
+	if emptyPolicy != "" {
+		t.Fatalf("empty policy should map to all (no path filter), got %q", emptyPolicy)
 	}
 
 	allBlock := renderRouteCachePolicyCondition(routeCacheConfig{Enabled: true, Policy: "all"})