feat(P31): encryption-by-default + per-stack CMK (REQ-83, REQ-84, REQ-85)

---ci---
project: acdl
phase: 31
milestone: v1.8
status: execute
---/ci---

- New kms-key L1 primitive (aws:kms:key) with enable_key_rotation=true
  (AWS-managed annual rotation, D-075). Registered in registry.json.
- Adapter TYPE_MAP expanded for aws:kms:key + aws:kms:alias.
- Adapter emits enable_key_rotation from NFR.
- S3 adapter emits server_side_encryption_configuration with KMS when
  kms_key_arn provided; managed KMS fallback with stderr warning when not.
- All 10 existing L1 primitives now have encryption_enabled NFR (default true).
- s3, rds, ecr, ecs-service, ecs-cluster have kms_key_arn input.
- Both L2 compositions (static-assets, microservice) now include a kms-key
  child + wires connecting kms_key_arn to children.
- L2 stack outputs include kms_key_arn.

Tests: +7 (300 -> 307). All pass. run_platform.sh --check-only green
(static-assets now resolves to 5 resources with the CMK).

adapters/terraform/adapter.py

@@ -40,6 +40,8 @@ TYPE_MAP = {
     "aws:cloudfront:originaccesscontrol": "aws_cloudfront_origin_access_control",
     "aws:wafv2:webacl": "aws_wafv2_web_acl",
     "aws:rds:instance": "aws_db_instance",
+    "aws:kms:key": "aws_kms_key",
+    "aws:kms:alias": "aws_kms_alias",
 }
 
 # Stack input name -> Terraform arg name, per stack type. Only non-identity
@@ -62,6 +64,8 @@ INPUT_MAP = {
     "aws:cloudfront:originaccesscontrol": {"name": "name", "origin_type": "origin_access_control_origin_type", "signing_behavior": "origin_access_control_signing_behavior"},
     "aws:wafv2:webacl": {"name": "name", "scope": "scope", "default_action": "default_action", "rules": "rules"},
     "aws:rds:instance": {"db_name": "db_name", "instance_class": "instance_class", "allocated_storage": "allocated_storage", "engine": "engine", "engine_version": "engine_version", "username": "username", "multi_az": "multi_az", "storage_encrypted": "storage_encrypted"},
+    "aws:kms:key": {"description": "description", "deletion_window_days": "deletion_window_in_days"},
+    "aws:kms:alias": {},
 }
 
 # Stack output name -> Terraform attribute name, per stack type. Only
@@ -84,6 +88,8 @@ OUTPUT_MAP = {
     "aws:cloudfront:originaccesscontrol": {"oac_id": "id"},
     "aws:wafv2:webacl": {"web_acl_arn": "arn"},
     "aws:rds:instance": {"db_endpoint": "endpoint", "db_arn": "arn"},
+    "aws:kms:key": {"kms_key_arn": "arn", "kms_key_id": "key_id"},
+    "aws:kms:alias": {},
 }
 
 
@@ -420,6 +426,44 @@ def _emit_resource(resource, type_by_id=None):
         # Dev safety: skip the final snapshot so `terraform destroy` works
         # without a final DB snapshot (overridden by deletion_protection).
         body.append("skip_final_snapshot = true")
+    if rtype == "aws:kms:key":
+        nfrs = resource.get("nfrs", {})
+        enable_rotation = nfrs.get("enable_rotation", True)
+        body.append(f"enable_key_rotation = {_tf_value(enable_rotation)}")
+    if rtype == "aws:s3:bucket":
+        nfrs = resource.get("nfrs", {})
+        encryption_enabled = nfrs.get("encryption_enabled", True)
+        if encryption_enabled:
+            kms_key_arn = inputs.get("kms_key_arn")
+            if kms_key_arn and isinstance(kms_key_arn, str) and kms_key_arn.startswith("ref:"):
+                kms_ref = _ref_expr(kms_key_arn, type_by_id)
+                body.append("server_side_encryption_configuration {")
+                body.append("  rule {")
+                body.append("    apply_server_side_encryption_by_default {")
+                body.append(f"      sse_algorithm = \"aws:kms\"")
+                body.append(f"      kms_master_key_id = {kms_ref}")
+                body.append("    }")
+                body.append("  }")
+                body.append("}")
+            elif kms_key_arn:
+                body.append("server_side_encryption_configuration {")
+                body.append("  rule {")
+                body.append("    apply_server_side_encryption_by_default {")
+                body.append("      sse_algorithm = \"aws:kms\"")
+                body.append(f"      kms_master_key_id = {_tf_value(kms_key_arn)}")
+                body.append("    }")
+                body.append("  }")
+                body.append("}")
+            else:
+                import sys
+                print(f"WARNING: s3 bucket {rid} has no kms_key_arn — falling back to AWS-managed key (alias/aws/s3)", file=sys.stderr)
+                body.append("server_side_encryption_configuration {")
+                body.append("  rule {")
+                body.append("    apply_server_side_encryption_by_default {")
+                body.append("      sse_algorithm = \"aws:kms\"")
+                body.append("    }")
+                body.append("  }")
+                body.append("}")
     return _resource_block(rid, tf_type, body)