fix: harden terminal-scoped analytics contracts

Keep JSON and bounded CSV exports on one canonical predicate, replace replayable offsets with encrypted tenant/filter-bound keyset cursors, and suppress merchant-grain peers under terminal scope. Validate period filters and align OpenAPI and capability specs with runtime behavior.

internal/config/config.go

@@ -16,6 +16,7 @@ type Config struct {
 	DemoUsername   string
 	DemoPassword   string
 	SessionSecret  string
+	CursorSecret   string
 	FrontendOrigin string
 	CookieSecure   bool
 }
@@ -30,6 +31,7 @@ func Load() (Config, error) {
 		DemoUsername:   value("DEMO_USERNAME", "merchant-0001"),
 		DemoPassword:   os.Getenv("DEMO_PASSWORD"),
 		SessionSecret:  os.Getenv("SESSION_SECRET"),
+		CursorSecret:   os.Getenv("CURSOR_SECRET"),
 		FrontendOrigin: value("FRONTEND_ORIGIN", "http://localhost:5173"),
 	}
 
@@ -48,6 +50,12 @@ func (c Config) ValidateAPI() error {
 	if len(c.SessionSecret) < 32 {
 		return errors.New("config: SESSION_SECRET must contain at least 32 characters")
 	}
+	if len(c.CursorSecret) < 32 {
+		return errors.New("config: CURSOR_SECRET must contain at least 32 characters")
+	}
+	if c.CursorSecret == c.SessionSecret {
+		return errors.New("config: CURSOR_SECRET must differ from SESSION_SECRET")
+	}
 	return nil
 }