feat(aws): storage.rds DatabaseProxy + ServerlessCluster v1 (deprecation-kept) [stacked on #148]

[so0k]

Storage slice PR 6/6 (RDS series finale) — DatabaseProxy + ServerlessCluster v1 (v2.263.0)

Stacked on #148. Completes the aws-rds port: proxy.ts (885 lines), proxy-endpoint.ts (271), serverless-cluster.ts (1,276), plus the addProxy() wiring that earlier PRs TODO-deferred (DatabaseClusterBase.addProxy / DatabaseInstanceBase.addProxy now real). 721 rds-suite tests green.

DatabaseProxy

• The largest Terraform-mapping deviation of this PR: upstream's single CfnDBProxyTargetGroup splits into aws_db_proxy_default_target_group + aws_db_proxy_target (with an explicit depends_on edge). Every connection_pool_config sub-field (borrowTimeout, initQuery, maxConnectionsPercent, maxIdleConnectionsPercent, sessionPinningFilters) plus debug_logging/idle_client_timeout/require_tls/iam_auth: REQUIRED is asserted end-to-end across the split (coverage added after the adversarial verify flagged the gap).
• Proxy role secret grants, TLS default, engine-family derivation (MySQL/MariaDB → MYSQL, Postgres → POSTGRESQL), DbProxyEndpoint with target roles.

ServerlessCluster v1 — kept, deprecation-marked, honestly documented

Per explicit direction: ported in full (1,276 lines incl. ServerlessClusterFromSnapshot, v1 scaling_configuration with autoPause/ACU min-max, enableDataApi → enable_http_endpoint), not dropped. Two layers of deprecation truth:

• Upstream v2.263.0 carries zero @deprecated tags in this file (it predates the convention) — this port adds 14 @deprecated markers (every public class/interface) because AWS has retired Aurora Serverless v1 (engine_mode: "serverless" is no longer creatable). The class docs state this explicitly.
• Consequently this construct ships for API/migration parity with unit-level validation only — a live deploy is impossible by AWS policy, not by port limitation. (DatabaseProxy carries the live-integ burden for this PR.)

Live integ (make rds.proxy) — receipts in thread

Real RDS Proxy fronting a live MySQL db.t3.micro (major-only VER_8_0, sidestepping the retired-minor trap from #148): proxy available with MYSQL engine family + TLS required, instance registered as a target through the resource split, zero-drift plan, clean destroy.

[so0k]

Live apply/verify/destroy receipts — make rds.proxy (aws-vault → tcons-vincent, us-east-1)

Run 2 (final) — PASS 665.77s:

TestRdsProxy 23:37:05 Apply complete! Resources: 19 added, 0 changed, 0 destroyed.
rds_proxy_test.go:47: rdsproxyproxy8148d86e available (engine family MYSQL, TLS required)
rds_proxy_test.go:70: instance rdsproxydatabase6f6e6f4b registered as proxy target   <-- through the default-target-group/target resource split
(drift oracle: tofu plan -detailed-exitcode == 0 — clean; also proves the omitted client_password_auth_type does NOT drift)
TestRdsProxy 23:42:25 Destroy complete! Resources: 19 destroyed.
--- PASS: TestRdsProxy (665.77s)

Run 1 — live-caught construct defect (9th live-only catch of the storage campaign): the Terraform provider validates aws_db_proxy.name as lowercase-only at plan time (only lowercase alphanumeric characters and hyphens allowed in "name") — the generated uniqueResourceName default carried uppercase (and the port's comment explicitly claimed proxies escape lowercasing). Fixed in proxy.ts + proxy-endpoint.ts with a /^[a-z0-9-]+$/ regression test.

Honest-verification note: mid-run-2 I briefly misread the destroy plan's client_password_auth_type -> null attribute listing as drift and drafted an explicit-default emission; the run then PASSED with a clean oracle, proving the omission is drift-free — the speculative change was reverted before commit and the shipped code is byte-identical to what run 2 validated (plus an in-code NOTE documenting the verified-no-drift behavior).

ServerlessCluster v1: no live run is possible — AWS retired engine_mode: "serverless". Ships deprecation-marked (14 added @deprecated tags; upstream has none) for API/migration parity, unit-validated (723 rds tests).