fix(logs): collect access logs regardless of plugin order

Global Router.Use middleware is applied at HTTP Start instead of
being snapshotted when each route is registered, so risk_control
still wraps admin APIs that mount earlier. Access-log collection
is enabled by default on SQLite/Postgres, not only ClickHouse.

backend/core/extpoints/extpoints_test.go

@@ -80,12 +80,12 @@ func TestRouterExtension(t *testing.T) {
 	for _, route := range routes {
 		if route.Method == "GET" && route.Path == "/api/v1/orders" {
 			foundOrderGet = true
-			assert.Equal(t, []any{mGlobal, mAPI, "api_extra_middleware"}, route.Middlewares)
+			assert.Equal(t, []any{mAPI, "api_extra_middleware"}, route.Middlewares)
 			assert.Equal(t, []any{hList}, route.Handlers)
 		}
 		if route.Method == "PUT" && route.Path == "/api/v1/admin/users/:id" {
 			foundUserPut = true
-			assert.Equal(t, []any{mGlobal, mAPI, "api_extra_middleware", mAdmin}, route.Middlewares)
+			assert.Equal(t, []any{mAPI, "api_extra_middleware", mAdmin}, route.Middlewares)
 			assert.Equal(t, []any{hUserPut}, route.Handlers)
 		}
 	}
@@ -93,6 +93,21 @@ func TestRouterExtension(t *testing.T) {
 	assert.True(t, foundUserPut)
 }
 
+func TestRouterGlobalMiddlewareIsNotSnapshottedOntoRoutes(t *testing.T) {
+	r := extpoints.NewRouterRegistry()
+	r.GET("/before", "handler")
+	r.Use("late_global")
+	r.GET("/after", "handler")
+
+	for _, route := range r.Routes() {
+		if len(route.Middlewares) != 0 {
+			t.Errorf("route %s %s Middlewares = %v, want none (globals live on Router.Middlewares)",
+				route.Method, route.Path, route.Middlewares)
+		}
+	}
+	assert.Equal(t, []any{"late_global"}, r.Middlewares())
+}
+
 func TestRouterWhitelist(t *testing.T) {
 	r := extpoints.NewRouterRegistry()
 	require.NotNil(t, r)