refactor(monitoring): N2 - tach monitoring_tab.py, CanonicalAuditLogger, MonitoringQueryService, go circular import, sandbox matrix

- ui/monitoring_tab.py (1546 dong) tach thanh presentation/monitoring/**
  (container + 7 tab/card + shared helper), ui/monitoring_tab.py con lai
  re-export shim de app.py khong doi.
- infrastructure/telemetry/audit_logger.py: CanonicalAuditLogger, core/audit_log.py
  thanh wrapper mong, tuong thich nguoc 100% voi schema .jsonl cu.
- application/monitoring/monitoring_query_service.py: MonitoringQueryService
  read-only, filter/sort/pagination, khong import PySide6.
- Go circular import model_pricing<->usage_tracker va agent_security<->
  agent_security_alert (core/agent_security_types.py moi).
- infrastructure/sandbox/sandbox_capabilities.py: SandboxCapabilityMatrix
  theo OS (Windows/Linux/macOS), chua dau noi vao core/sandbox_manager.py.
- conftest.py: sua loi checkout khong ten cowork_local khien pytest import
  nham thu muc khac.
- 77 test moi, 167/167 pass. QA da xac nhan UI/business logic khong doi
  (xem evidence/report/unified_report.html).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/test_model_pricing_usage_cycle.py

@@ -0,0 +1,60 @@
+"""Task 4a — model_pricing <-> usage_tracker circular dependency is gone.
+
+Before this fix, ``model_pricing.turn_cost_usd`` deferred-imported
+``usage_tracker`` for its flat fallback rates, while ``usage_tracker.set_budget``
+deferred-imported ``model_pricing`` for currency conversion — a real
+architectural cycle, only avoided at runtime by pushing both imports inside
+function bodies. Now ``model_pricing`` is a leaf module (it owns its own
+fallback rates) and ``usage_tracker`` imports it at module top level.
+"""
+from __future__ import annotations
+
+import copy
+import sys
+
+from cowork_local.config import AppConfig, DEFAULT_CONFIG
+from cowork_local.core import model_pricing, usage_tracker
+
+
+def test_model_pricing_does_not_depend_on_usage_tracker_module_level() -> None:
+    assert "usage_tracker" not in model_pricing.__dict__
+    assert "usage_tracker" not in getattr(model_pricing, "__all__", [])
+
+
+def test_usage_tracker_imports_model_pricing_at_top_level() -> None:
+    assert usage_tracker.mp is model_pricing
+
+
+def test_turn_cost_usd_fallback_matches_pre_refactor_default_rates(tmp_path) -> None:
+    config = AppConfig(data=copy.deepcopy(DEFAULT_CONFIG), path=tmp_path / "config.json")
+    # No matching row in the price table and no override in config.data["usage"]
+    # -> falls back to the flat rates that used to live in
+    # usage_tracker.DEFAULT_PRICING (0.5 in / 1.5 out USD per 1M tokens).
+    cost = model_pricing.turn_cost_usd("some-unknown-model", 1_000_000, 1_000_000, config)
+    assert cost == 0.5 + 1.5
+
+
+def test_turn_cost_usd_honours_usage_override_like_before(tmp_path) -> None:
+    config = AppConfig(data=copy.deepcopy(DEFAULT_CONFIG), path=tmp_path / "config.json")
+    config.data.setdefault("usage", {})["price_per_mtok_in_usd"] = 2.0
+    config.data["usage"]["price_per_mtok_out_usd"] = 4.0
+    cost = model_pricing.turn_cost_usd("some-unknown-model", 1_000_000, 1_000_000, config)
+    assert cost == 2.0 + 4.0
+
+
+def test_set_budget_still_converts_via_model_pricing(tmp_path) -> None:
+    config = AppConfig(data=copy.deepcopy(DEFAULT_CONFIG), path=tmp_path / "config.json")
+    usage_tracker.set_budget(config, 100.0, currency="USD")
+    status = usage_tracker.budget_status(config)
+    assert status is not None
+    assert status["amount_usd"] == 100.0
+
+
+def test_no_import_time_cycle_when_loaded_fresh() -> None:
+    for name in ("cowork_local.core.model_pricing", "cowork_local.core.usage_tracker"):
+        sys.modules.pop(name, None)
+    import importlib
+
+    mp = importlib.import_module("cowork_local.core.model_pricing")
+    ut = importlib.import_module("cowork_local.core.usage_tracker")
+    assert ut.mp is mp