fix: harden terminal-scoped analytics contracts

Keep JSON and bounded CSV exports on one canonical predicate, replace replayable offsets with encrypted tenant/filter-bound keyset cursors, and suppress merchant-grain peers under terminal scope. Validate period filters and align OpenAPI and capability specs with runtime behavior.

docs/openapi.yaml

@@ -435,25 +435,9 @@ paths:
         - $ref: '#/components/parameters/DetailViewQuery'
         - $ref: '#/components/parameters/FailureStageQuery'
         - $ref: '#/components/parameters/TerminalIdQuery'
-        - name: status
-          in: query
-          required: false
-          schema:
-            $ref: '#/components/schemas/SessionStatus'
-        - name: minAmountRial
-          in: query
-          required: false
-          schema:
-            type: integer
-            format: int64
-            minimum: 0
-        - name: maxAmountRial
-          in: query
-          required: false
-          schema:
-            type: integer
-            format: int64
-            minimum: 0
+        - $ref: '#/components/parameters/SessionStatusQuery'
+        - $ref: '#/components/parameters/MinAmountRialQuery'
+        - $ref: '#/components/parameters/MaxAmountRialQuery'
         - $ref: '#/components/parameters/CursorQuery'
         - $ref: '#/components/parameters/LimitQuery'
         - $ref: '#/components/parameters/RequestIdHeader'
@@ -543,6 +527,9 @@ paths:
         - $ref: '#/components/parameters/DetailViewQuery'
         - $ref: '#/components/parameters/FailureStageQuery'
         - $ref: '#/components/parameters/TerminalIdQuery'
+        - $ref: '#/components/parameters/SessionStatusQuery'
+        - $ref: '#/components/parameters/MinAmountRialQuery'
+        - $ref: '#/components/parameters/MaxAmountRialQuery'
         - $ref: '#/components/parameters/RequestIdHeader'
       responses:
         '200':
@@ -681,6 +668,28 @@ components:
         minLength: 1
         maxLength: 128
         pattern: '^[A-Za-z0-9._:-]+$'
+    SessionStatusQuery:
+      name: status
+      in: query
+      required: false
+      schema:
+        $ref: '#/components/schemas/SessionStatus'
+    MinAmountRialQuery:
+      name: minAmountRial
+      in: query
+      required: false
+      schema:
+        type: integer
+        format: int64
+        minimum: 0
+    MaxAmountRialQuery:
+      name: maxAmountRial
+      in: query
+      required: false
+      schema:
+        type: integer
+        format: int64
+        minimum: 0
     CursorQuery:
       name: cursor
       in: query
@@ -1550,7 +1559,11 @@ components:
         metadata: {$ref: '#/components/schemas/ReadySectionMetadata'}
         reason:
           type: string
-          const: INSUFFICIENT_COHORT
+          enum: [INSUFFICIENT_COHORT, TERMINAL_SCOPE_UNSUPPORTED]
+          description: |
+            `TERMINAL_SCOPE_UNSUPPORTED` is returned for terminal-scoped runs because
+            the approved peer cohort is merchant-grain and must not be presented as
+            if it benchmarked one terminal.
         eligiblePeerCount:
           type: integer
           minimum: 0