fix(logs): collect access logs regardless of plugin order

Global Router.Use middleware is applied at HTTP Start instead of
being snapshotted when each route is registered, so risk_control
still wraps admin APIs that mount earlier. Access-log collection
is enabled by default on SQLite/Postgres, not only ClickHouse.

backend/plugins/domain/risk_control/logstore/db_helper.go

@@ -42,10 +42,8 @@ func SetChDBForTest(db *gorm.DB) {
 }
 
 func getDB(ctx context.Context) *gorm.DB {
-	if c, ok := ctx.(*core.Context); ok && c != nil {
-		if s, err := core.Inject[contracts.DBService](c); err == nil && s != nil {
-			return s.DB(ctx)
-		}
+	if s, err := core.InjectFrom[contracts.DBService](ctx); err == nil && s != nil {
+		return s.DB(ctx)
 	}
 	dbMu.RLock()
 	s := dbSvc

backend/plugins/domain/risk_control/plugin.go

@@ -91,7 +91,9 @@ func (p *Plugin) Apply(ctx *core.Context) error {
 	var dbCfg rcDBConfig
 	_ = ctx.Config().Bind("database", &dbCfg)
 
-	SetAccessLogEnabled(chCfg.Enabled)
+	// Access logs persist on the active log database (SQLite / Postgres / ClickHouse).
+	// Collection is independent of ClickHouse being enabled.
+	SetAccessLogEnabled(true)
 	logstore.SetDefaultDatabases(dbCfg.Enabled, chCfg.Enabled)
 
 	core.Bind[contracts.DBService](ctx, logstore.SetDBService)

backend/plugins/domain/risk_control/plugin_test.go

@@ -35,6 +35,8 @@ func TestRiskControlPluginUnit(t *testing.T) {
 	setting, ok := ctx.Settings().Get("risk_control.enable_access_log")
 	require.True(t, ok)
 	assert.Equal(t, true, setting.Default)
+	assert.True(t, risk_control.IsAccessLogEnabled(),
+		"access log collection must be on even when ClickHouse is disabled")
 
 	require.NoError(t, ctx.Dispose())
 	assert.False(t, customMWCalled) // not dispatched via gin engine here