fix: harden terminal-scoped analytics contracts

Keep JSON and bounded CSV exports on one canonical predicate, replace replayable offsets with encrypted tenant/filter-bound keyset cursors, and suppress merchant-grain peers under terminal scope. Validate period filters and align OpenAPI and capability specs with runtime behavior.

internal/analytics/service_test.go

@@ -0,0 +1,13 @@
+package analytics
+
+import "testing"
+
+func TestPeerComparisonSupported(t *testing.T) {
+	t.Parallel()
+	if peerComparisonSupported("T318") {
+		t.Fatal("peerComparisonSupported() = true for terminal scope")
+	}
+	if !peerComparisonSupported("") {
+		t.Fatal("peerComparisonSupported() = false for merchant scope")
+	}
+}