feat(P27): RDS primitive + adapter expansion (D-059)

Add modules/l1/rds/ with interface.json (engine enum for postgres, mysql,
mariadb, sqlserver, oracle), instance.json, README.md (full template with
compliance extension points). Register in registry.json. Expand the
adapter TYPE_MAP/INPUT_MAP/OUTPUT_MAP for aws:rds:instance -> aws_db_instance;
emit backup_retention_period, deletion_protection, storage_encrypted, and
skip_final_snapshot from NFRs/inputs. Add RDS to the primitives-plan matrix.
Update tests for the new registry entry count (12) + RDS adapter emission.

---ci---
project: acdl
phase: 27
milestone: v1.7
status: execute
---/ci---

adapters/terraform/adapter.py

@@ -39,6 +39,7 @@ TYPE_MAP = {
     "aws:cloudfront:distribution": "aws_cloudfront_distribution",
     "aws:cloudfront:originaccesscontrol": "aws_cloudfront_origin_access_control",
     "aws:wafv2:webacl": "aws_wafv2_web_acl",
+    "aws:rds:instance": "aws_db_instance",
 }
 
 # Stack input name -> Terraform arg name, per stack type. Only non-identity
@@ -60,6 +61,7 @@ INPUT_MAP = {
     "aws:cloudfront:distribution": {"bucket_regional_domain_name": "origin_domain_name", "price_class": "price_class", "viewer_protocol_policy": "viewer_protocol_policy", "default_ttl": "default_ttl", "max_ttl": "max_ttl", "waf_web_acl_arn": "web_acl_id"},
     "aws:cloudfront:originaccesscontrol": {"name": "name", "origin_type": "origin_access_control_origin_type", "signing_behavior": "origin_access_control_signing_behavior"},
     "aws:wafv2:webacl": {"name": "name", "scope": "scope", "default_action": "default_action", "rules": "rules"},
+    "aws:rds:instance": {"db_name": "db_name", "instance_class": "instance_class", "allocated_storage": "allocated_storage", "engine": "engine", "engine_version": "engine_version", "username": "username", "multi_az": "multi_az", "storage_encrypted": "storage_encrypted"},
 }
 
 # Stack output name -> Terraform attribute name, per stack type. Only
@@ -81,6 +83,7 @@ OUTPUT_MAP = {
     "aws:cloudfront:distribution": {"distribution_arn": "arn", "distribution_domain_name": "domain_name", "oac_id": "origin_access_control_id"},
     "aws:cloudfront:originaccesscontrol": {"oac_id": "id"},
     "aws:wafv2:webacl": {"web_acl_arn": "arn"},
+    "aws:rds:instance": {"db_endpoint": "endpoint", "db_arn": "arn"},
 }
 
 
@@ -362,6 +365,22 @@ def _emit_resource(resource, type_by_id=None):
             body.append("    sampled_requests_enabled = true")
             body.append("  }")
             body.append("}")
+    if rtype == "aws:rds:instance":
+        # Emit NFR-derived arguments: backup_retention_period +
+        # deletion_protection from the nfrs block. Also emit
+        # storage_encrypted = true (from inputs, already emitted above if
+        # present) and skip_final_snapshot = true for dev safety.
+        nfrs = resource.get("nfrs", {})
+        backup_retention = nfrs.get("backup_retention_period", 7)
+        deletion_protection = nfrs.get("deletion_protection", True)
+        body.append(f"backup_retention_period = {_tf_value(backup_retention)}")
+        body.append(f"deletion_protection = {_tf_value(deletion_protection)}")
+        # Ensure storage_encrypted is emitted (defaults to true if not in inputs).
+        if "storage_encrypted" not in inputs:
+            body.append("storage_encrypted = true")
+        # Dev safety: skip the final snapshot so `terraform destroy` works
+        # without a final DB snapshot (overridden by deletion_protection).
+        body.append("skip_final_snapshot = true")
     return _resource_block(rid, tf_type, body)