fix(ci): separate short-lived CI VPC + fix 8 module lifecycle failures

Two architectural changes:
1. Created terraform/ci-vpc/ — a short-lived VPC for L1 module lifecycle
   testing, separate from the long-lived platform VPC. Created before
   VPC-dependent modules (alb, ecs-service, rds, uptime) are tested,
   destroyed after. Outputs (vpc_id, subnet_ids, sg_id, cluster_arn) are
   passed to those modules via scripts/run_lifecycle_test.sh +
   run_lifecycle_destroy.sh wrappers that inject the CI VPC outputs into
   the example contracts.
2. Updated the workflow to use ci-vpc-apply → lifecycle (with artifact
   passing) → ci-vpc-destroy (always runs).

8 module-specific fixes:
- s3: unique bucket names (acdl-ci-s3a-simple/complex) instead of
  globally-taken 'my-simple-bucket'
- kms-key: alias name with no spaces (locals.tf → alias/acdl-ci-kms)
- iam-role: example contract uses role_name (not name, which the interface
  doesn't declare)
- ecs-service: example contract uses family (not name); VPC inputs
  (cluster_arn, subnets, security_group) injected by CI VPC wrapper
- uptime: added subnets, security_group, cluster_arn to interface + module;
  network_configuration is dynamic (only when subnets provided)
- rds: added subnet_ids input + db_subnet_group resource (conditional
  on subnet_ids being non-empty)
- alb: removed hardcoded placeholder sg/subnet values from examples;
  vpc_id + subnets + security_group injected by CI VPC wrapper
- cloudfront: removed invalid placeholder WAF ARN from complex example

Regression: 479 passed, 0 skipped, 5 deselected. All 24 example contracts
pass --check-only.

---ci---
project: acdl
phase: P59
milestone: v1.11
status: execute
---/ci---

tests/test_pipeline_contract.py

@@ -551,7 +551,7 @@ class TestModulesLifecyclePipeline:
 
     def test_workflow_has_three_jobs(self):
         wf = _load_workflow(".gitea/workflows/modules-lifecycle.yml")
-        assert set(wf["jobs"].keys()) == {"platform-vpc-apply", "lifecycle", "platform-vpc-destroy"}
+        assert set(wf["jobs"].keys()) == {"ci-vpc-apply", "lifecycle", "ci-vpc-destroy"}
 
     def test_workflow_triggers_match_contract(self):
         wf = _load_workflow(".gitea/workflows/modules-lifecycle.yml")
@@ -583,5 +583,5 @@ class TestModulesLifecyclePipeline:
 
     def test_platform_vpc_destroy_always_runs(self):
         wf = _load_workflow(".gitea/workflows/modules-lifecycle.yml")
-        destroy_job = wf["jobs"]["platform-vpc-destroy"]
-        assert destroy_job.get("if") == "always()", "platform-vpc-destroy must always run (cleanup)"
+        destroy_job = wf["jobs"]["ci-vpc-destroy"]
+        assert destroy_job.get("if") == "always()", "ci-vpc-destroy must always run (cleanup)"