feat(aws): storage.neptune — neptune-alpha port [stacked on #151]

[so0k]

Storage slice PR 9 — storage.neptune: the @aws-cdk/aws-neptune-alpha port (v2.263.0-alpha.0)

Stacked on #151. All 6 upstream files into storage.neptune, 83 tests. Second alpha port — same disciplines as #151: alpha-churn tracker on the barrel, aws-cdk-lib/interfaces markers stripped with TODO permalinks.

Mapping notes

• Neptune Serverless maps as a native typed serverless_v2_scaling_configuration block (known synchronously from props — the docdb pattern, no addOverride needed), with upstream's full validation set (min ≥ 1, max 2.5–128, min < max, db.serverless ⇢ config required).
• kmsKey maps to kms_key_arn — the provider's own field naming enforces the ARN form here (the feat(aws): storage.elasticache — elasticache-alpha port [stacked on #150] #151 id-vs-ARN lesson arrives pre-applied), asserted in tests.
• grant/grantConnect render the neptune-db:* IAM statements against the clusterResourceIdentifier-based ARN, flipping iam_database_authentication_enabled lazily exactly as upstream.
• House patterns: gridUUID-lowercased identifiers with the derived-base instance naming (<clusterid>instanceN, regression-tested), removalPolicy → skipFinalSnapshot/finalSnapshotIdentifier + synth warning, Lambda-backed cloudwatchLogsRetention TODO-omitted (native enable_cloudwatch_logs_exports wired), associatedRoles → iam_roles (ARNs).
• Upstream's Vpc.fromLookup test adapted to an imported security group (ContextProvider not ported — documented).

Build-process note (honesty)

The conversion workflow for this module was killed twice by API-connection failures mid-run and finally stalled; the remaining ~40% (the 936-line cluster.test.ts port and gates) was completed by hand and the whole surface re-verified against upstream during that port. Test counts: 35 upstream cluster tests → 33 ported + 2 LogRetention tests comment-omitted with permalinks + 2 repo-specific additions (grid naming, snapshot).

Live integ (make neptune.cluster) — receipts in thread

Real Neptune Serverless cluster (1–2.5 NCU) + db.serverless instance in an isolated VPC: engine/status/encryption read-backs, ServerlessV2ScalingConfiguration read back from AWS, the grid-derived instance identifier asserted live, drift oracle, clean destroy.

[so0k]

Live apply/verify/destroy receipts — make neptune.cluster (aws-vault → tcons-vincent, us-east-1)

Run 1 — PASS 1684.18s, first attempt:

TestNeptuneCluster 07:26:02 Apply complete! Resources: 11 added, 0 changed, 0 destroyed.
neptune_cluster_test.go:51: neptuneclusterclustera5a6ade9 available (neptune 1.4.7.0, serverless 1.0-2.5 NCU, encrypted)   <-- ServerlessV2ScalingConfiguration READ BACK from AWS (native typed block)
neptune_cluster_test.go:65: instance neptuneclusterclustera5a6ade9instance1 is db.serverless                              <-- grid-derived instance identifier asserted live
(drift oracle: tofu plan -detailed-exitcode == 0 — clean)
TestNeptuneCluster 07:38:27 Destroy complete! Resources: 11 destroyed.
--- PASS: TestNeptuneCluster (1684.18s)

First fixture of the slice to pass its live cycle on the very first attempt — the accumulated pattern set (kms ARN form, lowercase grid naming, native serverless block, skipFinalSnapshot) pre-empted every previously-caught defect class.