feat(aws): storage.docdb — complete aws-docdb port [stacked on #149]

[so0k]

Storage slice PR 7 — storage.docdb: the complete aws-docdb port (v2.263.0)

Stacked on #149. First non-RDS database module, proving the slice's reuse story: all 8 upstream files (1,608 LOC) into a new storage.docdb sub-namespace, 103 tests.

Reuse story (the point of the stack's ordering)

• CaCertificate imports from ../rds — the exact decoupling the Phase-0 prereqs PR (feat(aws): storage slice prereqs — SecretRotation (SAR) unblock, storage.rds scaffolding, CaCertificate #142) set up.
• Rotation (addRotationSingleUser/MultiUser) rides the live-proven encryption.SecretRotation SAR mechanism with the MongoDB rotation apps.
• Every house pattern carried from storage.rds: generated-password double-freeze (master_password + secret version under ignore_changes), removalPolicy → skipFinalSnapshot/finalSnapshotIdentifier + synth-time warning, attach() with number-typed port and dbClusterIdentifier, gridUUID-lowercased naming.

Notable specifics

• DocDB Serverless v2 maps as a native typed block — unlike rds (feat(aws): storage.rds DatabaseCluster + Aurora Serverless v2 + metric augmentations [stacked on #147] #148), no addOverride needed, because DocDB's serverless-ness is known synchronously from props rather than discovered post-instance-bind. (The cdktn block-typed-Lazy footgun only bites when the value is late-bound.)
• attach() hard-injects engine: "mongo" and ssl: "true" into the secret's connection fields — the MongoDB rotation Lambda requires them and DocDB defaults to TLS (documented deviation; CFN's server-side merge does the same).
• Instance naming: upstream auto-names instances from per-index CFN logical ids; a naive uniqueResourceName would collide across the creation loop, so instances reuse the derived (grid-scoped, lowercased) cluster identifier as their base — <clusterid>instance1 — preserving upstream's "base defaults to cluster name" semantic and the repo invariant (regression-tested; run 1's receipts show the provider tf-* auto-name this replaced).
• Omissions (all TODO-permalinked): copyTagsToSnapshot (no cluster-level provider arg; the instance-level one exists but repurposing it would change semantics — documented), Lambda-backed log retention (native enabled_cloudwatch_logs_exports is wired), CFN reference-marker interfaces. manage_master_user_password (provider-native, no upstream prop) deliberately not surfaced this slice — noted as a follow-up candidate.

Live integ (make docdb.cluster) — receipts in thread

Real DocumentDB 5.0 cluster + db.t3.medium instance in an isolated VPC: cluster/instance read-backs over the RDS API, the attached secret's full mongo connection payload (username/password/engine/ssl/host/number-port/dbClusterIdentifier), post-apply drift oracle, clean destroy. Run 1 PASS 1012s validated everything and exposed the provider-auto-named instance that motivated the naming fix; run 2 re-proves the full cycle with grid-named instances.

[so0k]

Live apply/verify/destroy receipts — make docdb.cluster (aws-vault → tcons-vincent, us-east-1)

Run 2 (final, grid-named instances) — PASS 918.97s:

TestDocdbCluster 01:00:44 Apply complete! Resources: 13 added, 0 changed, 0 destroyed.
docdb_cluster_test.go:49: docdbclustercluster2b3b2932 available (engine docdb 5.0.0, encrypted)
docdb_cluster_test.go:60: instance docdbclustercluster2b3b2932instance1 is db.t3.medium   <-- derived grid-scoped base + index (run 1 had provider tf-* auto-name)
docdb_cluster_test.go:75: attached secret carries mongo connection details incl. dbClusterIdentifier=docdbclustercluster2b3b2932
(drift oracle: tofu plan -detailed-exitcode == 0 — clean)
TestDocdbCluster 01:11:08 Destroy complete! Resources: 13 destroyed.
--- PASS: TestDocdbCluster (918.97s)

Run 1 — PASS 1012.47s on the pre-fix synth: validated everything (cluster read-back over the RDS API, db.t3.medium instance, the attach() secret merge with engine:"mongo"/ssl:"true"/number-port/dbClusterIdentifier, clean drift oracle, 13/13 destroy) and its receipts exposed the provider tf-* auto-named instance that motivated the naming fix (instances now reuse the derived grid-scoped cluster identifier as their base — upstream's base-defaults-to-cluster-name semantic + repo invariant both preserved, regression-tested).