feat(P31): encryption-by-default + per-stack CMK (REQ-83, REQ-84, REQ-85)

---ci---
project: acdl
phase: 31
milestone: v1.8
status: execute
---/ci---

- New kms-key L1 primitive (aws:kms:key) with enable_key_rotation=true
  (AWS-managed annual rotation, D-075). Registered in registry.json.
- Adapter TYPE_MAP expanded for aws:kms:key + aws:kms:alias.
- Adapter emits enable_key_rotation from NFR.
- S3 adapter emits server_side_encryption_configuration with KMS when
  kms_key_arn provided; managed KMS fallback with stderr warning when not.
- All 10 existing L1 primitives now have encryption_enabled NFR (default true).
- s3, rds, ecr, ecs-service, ecs-cluster have kms_key_arn input.
- Both L2 compositions (static-assets, microservice) now include a kms-key
  child + wires connecting kms_key_arn to children.
- L2 stack outputs include kms_key_arn.

Tests: +7 (300 -> 307). All pass. run_platform.sh --check-only green
(static-assets now resolves to 5 resources with the CMK).

modules/l1/ecr/interface.json

@@ -14,6 +14,11 @@
       "type": "string",
       "description": "AWS region the repository is created in.",
       "required": true
+    },
+    "kms_key_arn": {
+      "type": "string",
+      "description": "ARN of the CMK for repository encryption; if absent, uses AWS-managed key.",
+      "required": false
     }
   },
   "outputs": {
@@ -26,5 +31,16 @@
       "description": "The ECR repository ARN."
     }
   },
-  "nfrs": {}
+  "nfrs": {
+    "encryption_enabled": {
+      "type": "boolean",
+      "description": "Enable repository encryption (KMS).",
+      "default": true
+    },
+    "encryption_type": {
+      "type": "string",
+      "description": "Encryption type.",
+      "default": "KMS"
+    }
+  }
 }