refactor(monitoring): N2 - tach monitoring_tab.py, CanonicalAuditLogger, MonitoringQueryService, go circular import, sandbox matrix

- ui/monitoring_tab.py (1546 dong) tach thanh presentation/monitoring/**
  (container + 7 tab/card + shared helper), ui/monitoring_tab.py con lai
  re-export shim de app.py khong doi.
- infrastructure/telemetry/audit_logger.py: CanonicalAuditLogger, core/audit_log.py
  thanh wrapper mong, tuong thich nguoc 100% voi schema .jsonl cu.
- application/monitoring/monitoring_query_service.py: MonitoringQueryService
  read-only, filter/sort/pagination, khong import PySide6.
- Go circular import model_pricing<->usage_tracker va agent_security<->
  agent_security_alert (core/agent_security_types.py moi).
- infrastructure/sandbox/sandbox_capabilities.py: SandboxCapabilityMatrix
  theo OS (Windows/Linux/macOS), chua dau noi vao core/sandbox_manager.py.
- conftest.py: sua loi checkout khong ten cowork_local khien pytest import
  nham thu muc khac.
- 77 test moi, 167/167 pass. QA da xac nhan UI/business logic khong doi
  (xem evidence/report/unified_report.html).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

core/model_pricing.py

@@ -32,6 +32,14 @@ _SYMBOL_CCY = {"₫": "VND", "vnd": "VND", "đ": "VND",
 
 _DEFAULT_UNIT = "Million tokens"
 
+# Flat USD/1M-token fallback rates used by turn_cost_usd() when a model isn't
+# in the price table. Owned here (not usage_tracker.DEFAULT_PRICING) so this
+# module never needs to import usage_tracker — usage_tracker imports this
+# module instead, keeping the dependency one-directional. Values match
+# usage_tracker.DEFAULT_PRICING's price_per_mtok_in_usd/out_usd exactly.
+_FALLBACK_RATE_IN_USD = 0.5
+_FALLBACK_RATE_OUT_USD = 1.5
+
 
 # ---- currency ------------------------------------------------------------
 def _rates(config) -> Dict[str, float]:
@@ -138,9 +146,11 @@ def turn_cost_usd(model: str, in_tok: int, out_tok: int, config) -> float:
     switches models (a different model → its own row / rates)."""
     rates = usd_rates_for(model, config)
     if rates is None:
-        from . import usage_tracker as ut
-        p = {**ut.DEFAULT_PRICING, **((getattr(config, "data", {}) or {}).get("usage") or {})}
-        rates = {"in": float(p["price_per_mtok_in_usd"]), "out": float(p["price_per_mtok_out_usd"])}
+        usage = (getattr(config, "data", {}) or {}).get("usage") or {}
+        rates = {
+            "in": float(usage.get("price_per_mtok_in_usd", _FALLBACK_RATE_IN_USD)),
+            "out": float(usage.get("price_per_mtok_out_usd", _FALLBACK_RATE_OUT_USD)),
+        }
     return (in_tok or 0) / 1e6 * rates["in"] + (out_tok or 0) / 1e6 * rates["out"]