feat(aws): storage.rds DatabaseCluster + Aurora Serverless v2 + metric augmentations [stacked on #147]

[so0k]

Storage slice PR 5/N — storage.rds DatabaseCluster + Aurora Serverless v2 + metric augmentations (v2.263.0)

Stacked on #147. Lands cluster.ts/cluster-ref.ts (DatabaseCluster, DatabaseClusterFromSnapshot), aurora-cluster-instance.ts (ClusterInstance.provisioned()/serverlessV2() — explicit aws_rds_cluster_instance writer/readers with promotion tiers, replacing upstream's implicit-writer model at the resource level while keeping the same API), and rds-augmentations.generated.ts — the deferred metric mixin, produced by aws-cdk's real generate phase (in-repo spec2cdk @ v2.263.0, @aws-cdk/aws-service-spec@0.1.193; surface diffs clean vs the published bundle), wired as a side-effect import per the sqs/sns/ec2/lambda precedent. 635 rds-suite tests green (the 6,437-line upstream cluster.test.ts ported in full).

Aurora Serverless v2 (the headline)

writer: ClusterInstance.serverlessV2(...) + serverlessV2MinCapacity/MaxCapacity(/AutoPauseDuration) → serverlessv2_scaling_configuration. One deep cdktn finding here: block-typed L1 arguments never resolve Lazy tokens (the generated ComplexObject/internalValue wrapper bypasses whole-tree token resolution — verified against the provider codegen; scalar args like enable_http_endpoint resolve fine). The block is therefore applied via addOverride after instances are created, when hasServerlessInstance is definitively known. Documented consequence: an instance bound via the public bind() API after construction won't contribute the scaling block (upstream's synth-time Lazy.any would catch it) — bind via writer/readers props, or use the escape hatch.

This is the third instance of the block-typed-Lazy cdktn footgun this pipeline has hit (batch retry_strategy, now serverless-v2 scaling) — prepare-time/post-hoc emission is the house pattern.

Other design points

• House patterns mirrored from feat(aws): storage.rds DatabaseInstance — instance.ts + attach() protocol [stacked on #146] #147: generated-password double-freeze (master_password + secret version under accumulated ignore_changes — regression-tested this time), removalPolicy → skipFinalSnapshot/finalSnapshotIdentifier/deletionProtection + synth warning, attach() merging dbClusterIdentifier/engine/host/number-port/dbname, gridUUID-scoped identifiers for cluster and instances, enableDataApi → enable_http_endpoint.
• Legacy instanceProps migration path stays template-neutral: the gridUUID name default is deliberately skipped for isFromLegacyInstanceProps instances (documented) so migrating an unnamed legacy cluster doesn't force instance replacement.

Live integ (make rds.cluster) — receipts in thread

Real Aurora PostgreSQL 16.8 Serverless v2 cluster: scaling config 0.5–1.0 ACU read back from AWS (proving the addOverride emission), Data API enabled, db.serverless writer, attached secret with dbClusterIdentifier, zero-drift plan, 13/13 clean destroy. PASS 1205.95s. Run 1 was an AWS-availability catch, not a construct bug: upstream's v2.263.0 table carries VER_16_4, which AWS has retired — fixtures must cross-check describe-db-engine-versions.

[so0k]

Live apply/verify/destroy receipts — make rds.cluster (aws-vault → tcons-vincent, us-east-1)

Run 2 (final) — PASS 1205.95s:

TestRdsCluster 22:49:53 Apply complete! Resources: 13 added, 0 changed, 0 destroyed.
rds_cluster_test.go:55: rdsclusterclusterba70e117 available (aurora-postgresql, serverless v2 0.5-1.0 ACU, Data API on)   <-- ServerlessV2ScalingConfiguration READ BACK from AWS: the addOverride block-emission design works
rds_cluster_test.go:73: writer rdsclusterclusterwriter771a1985 is db.serverless
rds_cluster_test.go:88: attached secret carries full connection details incl. dbClusterIdentifier=rdsclusterclusterba70e117
(drift oracle: tofu plan -detailed-exitcode == 0 — silent = clean; proves master_password ignore_changes + serverlessv2 block read-back)
TestRdsCluster 23:02:18 Destroy complete! Resources: 13 destroyed.
--- PASS: TestRdsCluster (1205.95s)

Run 1 — AWS-availability catch (not a construct bug): CreateDBCluster ... Cannot find version 16.4 for aurora-postgresql — upstream's v2.263.0 table faithfully carries VER_16_4, but AWS has retired that minor. Fixture bumped to VER_16_8 (verified via describe-db-engine-versions). The table keeping retired versions is correct upstream fidelity; pick live-fixture versions against the API.

Also of note for review: the serverlessv2_scaling_configuration cannot be a Lazy token — cdktn's block-typed L1 args never resolve them (third instance of this footgun after batch's retry_strategy; documented in-code with the late-bind() consequence).