fix(security-audit): 仅在 blocking 意图下 fail-closed，修复无法关闭审计

configUntrusted 不再单独强制 ModeBlocking，避免默认关闭部署在配置
加载失败时对全部请求返回 prompt_guard_unavailable；成功保存配置后
清除 untrusted，确保管理员关闭提示词审计能立即生效。

Fixes #4560

backend/cmd/server/main.go

@@ -155,10 +155,11 @@ func runMainServer() {
 	defer app.Cleanup()
 	if app.PromptAudit != nil {
 		if err := app.PromptAudit.Start(context.Background()); err != nil {
-			// Startup continues so unrelated APIs stay up, but Prompt Audit itself
-			// fails closed (unavailable) until a later reload installs a trusted
-			// snapshot—avoiding a silent ModeOff bypass of persisted blocking policy.
-			log.Printf("Prompt Audit started in degraded fail-closed state: %v", err)
+			// Startup continues so unrelated APIs stay up. Fail-closed (unavailable)
+			// applies only when a persisted blocking policy was observed; without
+			// blocking intent, Prompt Audit stays ModeOff so the gateway remains
+			// usable and administrators can still disable the feature (#4560).
+			log.Printf("Prompt Audit started in degraded state: %v", err)
 		}
 	}