fix(logs): collect access logs regardless of plugin order

Global Router.Use middleware is applied at HTTP Start instead of
being snapshotted when each route is registered, so risk_control
still wraps admin APIs that mount earlier. Access-log collection
is enabled by default on SQLite/Postgres, not only ClickHouse.

backend/plugins/drivers/driver_http/plugin.go

@@ -252,27 +252,42 @@ func (p *Plugin) mountContextRoutes(ctx context.Context) error {
 	}
 	p.engine.Use(appContextMiddleware(ctx, p.coreCtx.Root()))
 	SetWhitelist(p.coreCtx.Router().Whitelist())
+
+	globalMW, err := toGinHandlers(p.coreCtx.Router().Middlewares())
+	if err != nil {
+		return fmt.Errorf("driver_http: invalid global middleware: %w", err)
+	}
+
 	for _, rd := range p.coreCtx.Router().Routes() {
-		allHandlers := make([]gin.HandlerFunc, 0, len(rd.Middlewares)+len(rd.Handlers))
-		for _, m := range rd.Middlewares {
-			gh, err := toGinHandler(m)
-			if err != nil {
-				return fmt.Errorf("driver_http: invalid middleware for route %s %s: %w", rd.Method, rd.Path, err)
-			}
-			allHandlers = append(allHandlers, gh)
+		routeMW, convErr := toGinHandlers(rd.Middlewares)
+		if convErr != nil {
+			return fmt.Errorf("driver_http: invalid middleware for route %s %s: %w", rd.Method, rd.Path, convErr)
 		}
-		for _, h := range rd.Handlers {
-			gh, err := toGinHandler(h)
-			if err != nil {
-				return fmt.Errorf("driver_http: invalid handler for route %s %s: %w", rd.Method, rd.Path, err)
-			}
-			allHandlers = append(allHandlers, gh)
+		handlers, convErr := toGinHandlers(rd.Handlers)
+		if convErr != nil {
+			return fmt.Errorf("driver_http: invalid handler for route %s %s: %w", rd.Method, rd.Path, convErr)
 		}
+		allHandlers := make([]gin.HandlerFunc, 0, len(globalMW)+len(routeMW)+len(handlers))
+		allHandlers = append(allHandlers, globalMW...)
+		allHandlers = append(allHandlers, routeMW...)
+		allHandlers = append(allHandlers, handlers...)
 		p.engine.Handle(rd.Method, rd.Path, allHandlers...)
 	}
 	return nil
 }
 
+func toGinHandlers(hs []any) ([]gin.HandlerFunc, error) {
+	out := make([]gin.HandlerFunc, 0, len(hs))
+	for _, h := range hs {
+		gh, err := toGinHandler(h)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, gh)
+	}
+	return out, nil
+}
+
 //nolint:contextcheck // middleware must wrap the gin request context, not Start's ctx
 func appContextMiddleware(_ context.Context, appCtx *core.Context) gin.HandlerFunc {
 	return func(c *gin.Context) {

backend/plugins/drivers/drivers_test.go

@@ -152,6 +152,41 @@ func TestHTTPDriverLifecycle(t *testing.T) {
 	require.NoError(t, err)
 }
 
+func TestHTTPDriverAppliesGlobalMiddlewareRegisteredAfterRoutes(t *testing.T) {
+	ctx := core.NewContext(context.Background())
+	ctx.Config().SetSource(core.NewMapSource(nil))
+	require.NoError(t, ctx.Config().Resolve())
+
+	ctx.Router().GET("/early", func(c *gin.Context) {
+		c.Status(http.StatusOK)
+	})
+
+	var called atomic.Bool
+	ctx.Router().Use(func(c *gin.Context) {
+		called.Store(true)
+		c.Next()
+	})
+
+	httpPlugin := driver_http.New(driver_http.WithAddr("127.0.0.1:0"))
+	require.NoError(t, httpPlugin.Apply(ctx))
+	d, ok := ctx.Driver(core.DriverTypeHTTP)
+	require.True(t, ok)
+	require.NoError(t, d.Start(context.Background()))
+	t.Cleanup(func() {
+		stopCtx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+		defer cancel()
+		_ = d.Stop(stopCtx)
+	})
+
+	resp, err := http.Get(fmt.Sprintf("http://%s/early", httpPlugin.Addr()))
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	if !called.Load() {
+		t.Fatal("Router.Use middleware registered after the route must still run at HTTP Start")
+	}
+}
+
 func TestAsynqWorkerDriverLifecycle(t *testing.T) {
 	mr, err := miniredis.Run()
 	require.NoError(t, err)