feat(P31): encryption-by-default + per-stack CMK (REQ-83, REQ-84, REQ-85)

---ci---
project: acdl
phase: 31
milestone: v1.8
status: execute
---/ci---

- New kms-key L1 primitive (aws:kms:key) with enable_key_rotation=true
  (AWS-managed annual rotation, D-075). Registered in registry.json.
- Adapter TYPE_MAP expanded for aws:kms:key + aws:kms:alias.
- Adapter emits enable_key_rotation from NFR.
- S3 adapter emits server_side_encryption_configuration with KMS when
  kms_key_arn provided; managed KMS fallback with stderr warning when not.
- All 10 existing L1 primitives now have encryption_enabled NFR (default true).
- s3, rds, ecr, ecs-service, ecs-cluster have kms_key_arn input.
- Both L2 compositions (static-assets, microservice) now include a kms-key
  child + wires connecting kms_key_arn to children.
- L2 stack outputs include kms_key_arn.

Tests: +7 (300 -> 307). All pass. run_platform.sh --check-only green
(static-assets now resolves to 5 resources with the CMK).

modules/l1/kms-key/instance.json

@@ -0,0 +1,33 @@
+{
+  "version": "1.0.0",
+  "stack": {
+    "name": "kms-key",
+    "kind": "l1",
+    "depth": 1
+  },
+  "resources": [
+    {
+      "id": "kms-key",
+      "type": "aws:kms:key",
+      "module": "kms-key@1.0.0",
+      "inputs": {
+        "description": "ACDL per-stack CMK",
+        "region": "us-east-1",
+        "deletion_window_days": 30
+      },
+      "outputs": {
+        "kms_key_arn": {
+          "type": "arn"
+        },
+        "kms_key_id": {
+          "type": "string"
+        }
+      },
+      "nfrs": {
+        "enable_rotation": true,
+        "deletion_protection": true,
+        "encryption_enabled": true
+      }
+    }
+  ]
+}