Add dated AI evidence handoff and harden privacy without losing context

[KAVentures]

After a recorder restart, the normal export could contain no events even though useful work remained in local history. Users also had no clear way to select several days and hand that evidence to their chosen AI.

This adds a shared work-period selector for Activity and exports, plus a Prepare for AI flow with event counts, observed dates, redacted examples, permission boundaries, an opportunity-discovery request and a redacted evidence ZIP. Analysis remains possible when repeated-work candidates are empty. Recorder status now acknowledges an unavailable collector or missing permissions.

Date bounds apply across exported evidence, derived summaries, tasks and work profiles. Calendar dates honor the browser timezone and DST. Canonical span durations remain intact; derived analysis clips spans at the selected end. Download tickets and Activity cursors bind the date bounds, and the preparation preview requires a dashboard session. Existing current/all API defaults remain supported. CSV event IDs are appended without moving existing columns.

Privacy fixes protect lowercase person searches while retaining business qualifiers, apply the same extensions during capture without depending on HTTP import order, and preserve strictly validated opaque project/file hashes that the identifier filter could mistake for payment cards. Existing installations rerun the checkpointed title-protection migration so retained evidence and derived views also receive the stronger protection. Actual card values outside those typed references remain redacted. No recording or AI permissions are enabled by this change.

Validation

• Full Python regression suite: 1,722 passed, 1 skipped (263.81 seconds).
• JavaScript suite: 122 passed, including DST and non-hour timezone cases.
• Architecture layering budget and authenticated dashboard JavaScript syntax checks passed.
• Chromium checks with 491 available recorded events: saved-history preview, default redacted ZIP, Activity custom dates, ordinary JSON export matching the selection, correct Stockholm UTC bounds, recorder waiting state, and no browser errors.
• Cross-layer tests cover date-bound isolation in JSON/CSV ZIP/XLSX, clipped analysis with unchanged canonical spans, offset-aware paging, recorder-state current-run boundaries, ticket tampering/reuse, dashboard-only preview, redaction idempotence, retained business context and deterministic project-hash collisions.
• No private recordings, exports or screenshots are included in this PR. Native capture was not changed; physical OS sensor accuracy is not established by these tests.

Startup migration fix (post-review)

• The new title-protection migration is never executed synchronously during server startup, including histories below the old 5,000-row threshold. ASGI schedules worker setup after a 3s grace period for the launcher health check. Once running, the worker uses 200-row checkpointed SQLite transactions with short sleeps between commits, avoiding long writes/CPU saturation while the recorder operates. Duplicate workers for the same DB in one process are suppressed; errors log only the exception type and a subsequent launch resumes from the saved checkpoint.
• The privacy migration completion marker stays false until every relevant row is processed; Full AI context and non-redacted exports remain redacted on read during the migration.
• Added regressions simulating a slow 300k-style historical scan without requiring 300k rows in CI, asserting startup health before scan, /health responsiveness during simulated work, short committed batches, derivative reconstruction and completion marker. This is not a measured 300k-record real-device benchmark; perform that before claiming a performance result on slower hardware.