fix(qa): resolve DF-002 through DF-011 from QA defect tracking sheet

Batch of fixes for defects tracked in "Task Tracking Template.xlsx" (sheet
Defect Management), verified against the sheet's Root Cause/Cach xu ly
columns before this commit:

- DF-002: Co4E node status not reflected after tab switch + missing
  edit-lock on running/done nodes (node_property_panel.py, co4e_runs.py,
  co4e_workflow_crud.py, co4e_canvas_widget.py, co4e_flow_tabs.py,
  canvas_items.py)
- DF-003: hide the run.bat console window unless the app exits with an
  error (run.bat, scripts/console_visibility.ps1 - new)
- DF-004: floating Help Assistant icon covering the Send button after a
  window resize (presentation/shell/main_window.py)
- DF-005: "block network" toggle didn't stop ICMP/raw-socket tools like
  ping (infrastructure/filesystem/command_tools.py,
  security/command_risk_classifier.py)
- DF-006: Monitoring "gay nang khi log lon" - root cause was re-reading
  the ENTIRE audit log history every 3s tick, not missing pagination;
  bounded to a 30-day window (presentation/monitoring/monitoring_tab.py)
  AND added the "So dong/trang" page-size control the ticket also asked
  for (presentation/monitoring/shared/event_table.py,
  shared/filter_scaffold.py, tabs/action_logs_tab.py, tabs/mcp_tab.py,
  tabs/security_events_tab.py, i18n/agents_admin_tab.py)
- DF-007: support choosing a OneDrive/SharePoint folder as a project's
  working directory via Microsoft Graph, downloaded as a local mirror
  with manual sync (core/projects.py, core/ms365_graph.py,
  core/cloud_workspace_sync.py - new, ui/ms365_signin_dialog.py - new,
  ui/cloud_folder_picker_dialog.py - new, i18n/cloud_workspace.py - new,
  ui/workspace_tab.py)
- DF-008: AI-edit instruction box was a fixed-height single-line QLineEdit;
  replaced with an auto-expanding, Enter-to-send/Shift+Enter-newline input
  (presentation/folder/ai_file_editor_dialog.py)
- DF-011: run_command failed with WinError 267 for a project whose
  per-turn output directory had never been created
  (application/conversations/core_runtime_adapter.py)

DF-009 (AI-edit Apply/Discard buttons easy to miss) and DF-010 (AI reply
language - dev-confirmed not a bug) are intentionally NOT part of this
commit: DF-009 has no code fix yet (still "Assigned" in the sheet, only a
UX recommendation was recorded), DF-010 was rejected as expected behavior.

Tests: tests/test_cloud_workspace_sync.py, tests/test_ms365_cloud_dialogs.py,
tests/test_ai_file_editor_input.py, tests/test_monitoring_page_size.py (all
new, all passing). Full suite: 896 passed, 13 known-and-documented failures
unrelated to this change (an existing core/audit_log.py bug, this checkout
not being a git repo before now, and a repo/subprocess folder-naming
mismatch affecting ~66 characterization tests) - see the sheet's DF-006
Evidence column for details.

presentation/monitoring/monitoring_tab.py

@@ -10,6 +10,7 @@ the ``status_message`` signal, ``select_subtab(index)``, ``nav_subtabs()``,
 """
 from __future__ import annotations
 
+from datetime import date, timedelta
 from typing import List
 
 from PySide6.QtCore import QTimer, Signal
@@ -25,11 +26,24 @@ from .tabs.overview_tab import OverviewTab
 from .tabs.security_events_tab import SecurityEventsTab
 
 _REFRESH_MS = 3000
-# Comfortably larger than any realistic audit-log size — the event tables
-# have never had pagination controls, so every tab still shows "all matching
-# events" exactly like before; MonitoringQueryService's pagination support
-# is exercised for real here, just not surfaced as UI (yet).
+# Comfortably larger than any realistic audit-log size for the WINDOW of
+# events _load_events() now actually reads (see _LOG_WINDOW_DAYS below) — this
+# is MonitoringQueryService's query-side page size, kept unbounded so it
+# always returns every matching event within the window; the user-facing
+# "Số dòng/trang" control (DF-006 — see shared/event_table.py::set_page_size,
+# shared/filter_scaffold.py::build_filter_scaffold's with_page_size) trims
+# that down for DISPLAY, client-side, per event tab.
 _UNBOUNDED_PAGE_SIZE = 100_000
+# _load_events() re-reads the audit log from disk every _REFRESH_MS (3s) via
+# _auto_refresh(), and audit_log.load_events()/load_shared_audit_events() are
+# day-sharded JSONL — unbounded start/end means EVERY day file ever written
+# gets re-read and re-parsed on EVERY tick, which is what actually made
+# Monitoring "gây nặng khi log lớn" (see DF-006): the slowness was never in
+# rendering (EventTable already caps display at 300 rows — see
+# shared/event_table.py::_MAX_ROWS), it was this repeated full-history read.
+# 30 days is a live-monitoring window, not a hard retention limit — nothing
+# is deleted, older days are simply not re-read on every 3s tick.
+_LOG_WINDOW_DAYS = 30
 
 
 class MonitoringTab(QWidget):
@@ -259,14 +273,20 @@ class MonitoringTab(QWidget):
 
         Có cấu hình thư mục chia sẻ VÀ đọc ra được dữ liệu thì dùng nó, để cả đội
         nhìn chung một bức tranh; rỗng thì rơi về nhật ký của máy này.
+
+        Chỉ đọc ``_LOG_WINDOW_DAYS`` ngày gần nhất — cả hai nguồn đều lưu theo
+        file JSONL từng ngày, nên bounding ở đây tránh việc đọc lại TOÀN BỘ
+        lịch sử mỗi 3 giây (xem ``_auto_refresh``), là nguyên nhân thật của
+        DF-006 (gây nặng khi log lớn).
         """
+        start = date.today() - timedelta(days=_LOG_WINDOW_DAYS)
         shared_dir = self.ctx.config.shared_dir
         if shared_dir:
             from ...core import telemetry_shared
-            shared_events = telemetry_shared.load_shared_audit_events(shared_dir)
+            shared_events = telemetry_shared.load_shared_audit_events(shared_dir, start=start)
             if shared_events:
                 return shared_events
-        return audit_log.load_events()
+        return audit_log.load_events(start=start)
 
     def _apply_events_to_event_tabs(self, events: List[dict]) -> None:
         """Filters the ALREADY-LOADED event list (see ``_load_events`` — one