chore(cdk): clean no-magic-numbers baseline and flip rule to error (#258 follow-up)

[krokoko]

Follow-up to #258 / PR #310.

PR #310 enabled @typescript-eslint/no-magic-numbers in cdk/ as advisory warn (~162 baseline hits). CLI and agent baselines were cleaned and the rules are blocking there; CDK was intentionally deferred.

Goal

Clean the CDK magic-number baseline and flip cdk/eslint.config.mjs from 'warn' to 'error' (matching cli/eslint.config.mjs).

Acceptance criteria

• All existing @typescript-eslint/no-magic-numbers violations in cdk/src/** are fixed (promote to named module constants, or to contracts/constants.json when values must agree across Python/TypeScript).
• cdk/eslint.config.mjs sets @typescript-eslint/no-magic-numbers to 'error'.
• mise //cdk:eslint exits 0 with 0 warnings/errors for magic numbers.
• mise run build green end-to-end.

Notes

• Shared allowlist stays as in feat(ci): no-magic-numbers (eslint) + PLR2004 (ruff) with allowlist (CA-10) #258 (0/1/-1/2, HTTP status codes, radix/unit factors). Tests remain exempt.
• See contracts/constants.md § Lint enforcement for where to put cross-language constants.
• Parent: feat(ci): no-magic-numbers (eslint) + PLR2004 (ruff) with allowlist (CA-10) #258 (CA-10, AI007).

[krokoko]

Starting implementation

[krokoko]

Starting implementation