AWS Keyspaces: follow-up parity gaps (GetTable defaults, rpc-v2-cbor, tag limit) #1666

Follow-up to #1512. These came up while fixing that issue in #1645 and during its review. None of them are fixed by #1645. Each item is a separate fix, and anyone is welcome to pick one up.

Medium

• GetTable always returns clientSideTimestamps {status: DISABLED} and ttl {status: DISABLED}, even for a table that never set them (server/aws/keyspaces/tables.go). With hashicorp/aws 6.66.0, a table that sets neither gets a forced replacement in terraform plan on every run. Only return them when they were set, or match whatever real Keyspaces returns.
• hashicorp/aws 6.69.x sends Keyspaces requests using the rpc-v2-cbor protocol to /service/KeyspacesService/operation/.... cloudemu serve doesn't route that, so that provider version can't create a keyspace at all. Needs a protocol route (see how other services handle rpc-v2-cbor).

Low

• The documented limit of 50 tags per resource is not enforced (the 60-per-request TagList bound is). The docs don't name the error code, so confirm it against real AWS before adding the check.

How to work on an item

1. Claim it. Comment here with the item you're picking up, so two people don't fix the same thing. Small PRs are easier to review, so take one item, or a few that share a root cause.

2. Find out what real AWS does. Read the AWS API reference for the operation, and if you can, check the real CLI or SDK. Match the real error code, HTTP status and message. Don't guess them. Put the doc link in your PR.

3. Branch from development. All PRs go to development, never main.

4. Put the fix in the right layer. cloudemu has three layers, and the same behaviour has to work from the Go library and from cloudemu serve:

• services/<service>/driver/driver.go holds the driver interface. Touch it only when you add a new operation or field.
• providers/aws/<service>/ is the in-memory backend, and this is where most fixes belong: validation, state changes, lifecycle and error codes. Use memstore.Store, idgen for IDs, cerrors for errors and config.FakeClock for anything time-based.
• server/aws/<service>/ is the wire handler. It only translates the AWS protocol (query/XML, JSON or REST) to provider calls and maps errors back to the AWS shape. Don't put business rules here, or the library and the server will drift apart.
• If you add new state, make sure it survives cloudemu serve --persist and snapshots. persist/completeness_test.go will tell you if you missed something.
• If you add or change operations, run go generate ./... so docs/coverage stays current, and commit the result.

See docs/architecture.md and docs/STRUCTURE.md for the layout and file naming.

5. Test it the way a user would.

• A provider test that fails before your fix and passes after it.
• A wire test that drives the handler with the real aws-sdk-go-v2 client, like the existing *_sdk_test.go files.
• Run cloudemu serve and try the change with the AWS CLI (aws --endpoint-url http://127.0.0.1:4566 ...), including the error cases.
• If Terraform has a resource for it, run apply, then plan (it should show no changes), then destroy.

6. Run the checks before you push. go build ./..., go vet and go test on the packages you touched (the full go test ./... if you can), and golangci-lint run --timeout=9m ./... with zero issues.

7. Open the PR. Say which item it fixes, what changed and why, and how you checked it (paste the CLI commands you ran). Add "Part of #1666" so we can tick the box here once it's merged. See CONTRIBUTING.md for setup and code style.