fix: harden terminal-scoped analytics contracts

Keep JSON and bounded CSV exports on one canonical predicate, replace replayable offsets with encrypted tenant/filter-bound keyset cursors, and suppress merchant-grain peers under terminal scope. Validate period filters and align OpenAPI and capability specs with runtime behavior.

cmd/api/main.go

@@ -35,7 +35,7 @@ func main() {
 		os.Exit(1)
 	}
 	defer pool.Close()
-	handler := api.NewServer(identity.New(pool), analytics.New(pool), logger, cfg.FrontendOrigin, cfg.CookieSecure).Handler()
+	handler := api.NewServer(identity.New(pool), analytics.New(pool, cfg.CursorSecret), logger, cfg.FrontendOrigin, cfg.CookieSecure).Handler()
 	server := &http.Server{Addr: cfg.HTTPAddr, Handler: handler, ReadHeaderTimeout: 5 * time.Second, ReadTimeout: 15 * time.Second, WriteTimeout: 65 * time.Second, IdleTimeout: 60 * time.Second}
 	go func() {
 		<-ctx.Done()