fix(logs): collect access logs regardless of plugin order

Global Router.Use middleware is applied at HTTP Start instead of
being snapshotted when each route is registered, so risk_control
still wraps admin APIs that mount earlier. Access-log collection
is enabled by default on SQLite/Postgres, not only ClickHouse.

backend/plugins/domain/risk_control/plugin.go

@@ -91,7 +91,9 @@ func (p *Plugin) Apply(ctx *core.Context) error {
 	var dbCfg rcDBConfig
 	_ = ctx.Config().Bind("database", &dbCfg)
 
-	SetAccessLogEnabled(chCfg.Enabled)
+	// Access logs persist on the active log database (SQLite / Postgres / ClickHouse).
+	// Collection is independent of ClickHouse being enabled.
+	SetAccessLogEnabled(true)
 	logstore.SetDefaultDatabases(dbCfg.Enabled, chCfg.Enabled)
 
 	core.Bind[contracts.DBService](ctx, logstore.SetDBService)