fix: harden terminal-scoped analytics contracts

Keep JSON and bounded CSV exports on one canonical predicate, replace replayable offsets with encrypted tenant/filter-bound keyset cursors, and suppress merchant-grain peers under terminal scope. Validate period filters and align OpenAPI and capability specs with runtime behavior.

internal/config/config_test.go

@@ -11,8 +11,25 @@ func TestLoadRequiresDatabaseURL(t *testing.T) {
 
 func TestValidateAPIRequiresLongSecret(t *testing.T) {
 	t.Parallel()
-	cfg := Config{SessionSecret: "short"}
+	cfg := Config{SessionSecret: "short", CursorSecret: "cursor-secret-that-is-at-least-32-bytes"}
 	if err := cfg.ValidateAPI(); err == nil {
 		t.Fatal("ValidateAPI() error = nil, want secret length error")
 	}
 }
+
+func TestValidateAPIRequiresLongCursorSecret(t *testing.T) {
+	t.Parallel()
+	cfg := Config{SessionSecret: "session-secret-that-is-at-least-32-bytes", CursorSecret: "short"}
+	if err := cfg.ValidateAPI(); err == nil {
+		t.Fatal("ValidateAPI() error = nil, want cursor secret length error")
+	}
+}
+
+func TestValidateAPIRequiresIndependentCursorSecret(t *testing.T) {
+	t.Parallel()
+	secret := "shared-secret-that-is-at-least-32-characters"
+	cfg := Config{SessionSecret: secret, CursorSecret: secret}
+	if err := cfg.ValidateAPI(); err == nil {
+		t.Fatal("ValidateAPI() error = nil, want independent secrets error")
+	}
+}