fix(logs): collect access logs regardless of plugin order

Global Router.Use middleware is applied at HTTP Start instead of
being snapshotted when each route is registered, so risk_control
still wraps admin APIs that mount earlier. Access-log collection
is enabled by default on SQLite/Postgres, not only ClickHouse.

backend/core/extpoints/extpoints_test.go

@@ -80,12 +80,12 @@ func TestRouterExtension(t *testing.T) {
 	for _, route := range routes {
 		if route.Method == "GET" && route.Path == "/api/v1/orders" {
 			foundOrderGet = true
-			assert.Equal(t, []any{mGlobal, mAPI, "api_extra_middleware"}, route.Middlewares)
+			assert.Equal(t, []any{mAPI, "api_extra_middleware"}, route.Middlewares)
 			assert.Equal(t, []any{hList}, route.Handlers)
 		}
 		if route.Method == "PUT" && route.Path == "/api/v1/admin/users/:id" {
 			foundUserPut = true
-			assert.Equal(t, []any{mGlobal, mAPI, "api_extra_middleware", mAdmin}, route.Middlewares)
+			assert.Equal(t, []any{mAPI, "api_extra_middleware", mAdmin}, route.Middlewares)
 			assert.Equal(t, []any{hUserPut}, route.Handlers)
 		}
 	}
@@ -93,6 +93,21 @@ func TestRouterExtension(t *testing.T) {
 	assert.True(t, foundUserPut)
 }
 
+func TestRouterGlobalMiddlewareIsNotSnapshottedOntoRoutes(t *testing.T) {
+	r := extpoints.NewRouterRegistry()
+	r.GET("/before", "handler")
+	r.Use("late_global")
+	r.GET("/after", "handler")
+
+	for _, route := range r.Routes() {
+		if len(route.Middlewares) != 0 {
+			t.Errorf("route %s %s Middlewares = %v, want none (globals live on Router.Middlewares)",
+				route.Method, route.Path, route.Middlewares)
+		}
+	}
+	assert.Equal(t, []any{"late_global"}, r.Middlewares())
+}
+
 func TestRouterWhitelist(t *testing.T) {
 	r := extpoints.NewRouterRegistry()
 	require.NotNil(t, r)

backend/core/extpoints/router.go

@@ -95,11 +95,12 @@ func (r *RouterRegistry) addRoute(method, fullPath string, handlers ...any) Rout
 
 	r.nextID++
 	rd := RouteDefinition{
-		ID:          r.nextID,
-		Method:      strings.ToUpper(method),
-		Path:        fullPath,
-		Handlers:    handlers,
-		Middlewares: append([]any(nil), r.middlewares...),
+		ID:       r.nextID,
+		Method:   strings.ToUpper(method),
+		Path:     fullPath,
+		Handlers: handlers,
+		// Global Router.Use middlewares are applied at HTTP Start from
+		// Router.Middlewares(), so late-registered plugins still wrap earlier routes.
 	}
 	r.routes = append(r.routes, rd)
 	return rd
@@ -241,9 +242,7 @@ func (g *RouterGroup) addRoute(method, fullPath string, handlers ...any) RouteDe
 	g.registry.mu.Lock()
 	defer g.registry.mu.Unlock()
 
-	allMiddlewares := make([]any, 0, len(g.registry.middlewares)+len(g.middlewares))
-	allMiddlewares = append(allMiddlewares, g.registry.middlewares...)
-	allMiddlewares = append(allMiddlewares, g.middlewares...)
+	allMiddlewares := append([]any(nil), g.middlewares...)
 
 	g.registry.nextID++
 	rd := RouteDefinition{