fix(cache): 存量空/url 策略规范为 all，避免静默收窄

评审修复：enabled 且 policy 为空或 url 时，写入/展示/快照/渲染均映射为 all，
保证旧站点宽缓存范围不变；新建 UI 仍显式提交 static 作为推荐默认。

pkg/render/openresty/render.go

@@ -497,13 +497,16 @@ func renderRouteCachePolicyCondition(cacheConfig routeCacheConfig) string {
 	}
 }
 
+// normalizeRenderCachePolicy maps stored policy for OpenResty generation.
+// Legacy empty and "url" mean "all GETs after security bypass" (pre-static default).
+// Explicit "static" uses the built-in extension allowlist. Unknown policies fall back to static.
 func normalizeRenderCachePolicy(raw string) string {
 	policy := strings.TrimSpace(strings.ToLower(raw))
 	switch policy {
-	case "", cachePolicyStatic:
-		return cachePolicyStatic
-	case cachePolicyURL, cachePolicyAll:
+	case "", cachePolicyURL, cachePolicyAll:
 		return cachePolicyAll
+	case cachePolicyStatic:
+		return cachePolicyStatic
 	case cachePolicySuffix, cachePolicyPathPrefix, cachePolicyPathExact:
 		return policy
 	default: