feat(gateway): support kmsKeyArn for customer-managed KMS encryption

### Description

`AWS::BedrockAgentCore::Gateway` exposes a `KmsKeyArn` property for customer-managed KMS encryption ([CFN docs](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-gateway.html)), but the CLI does not surface it. Customers with compliance requirements for CMK on every primitive cannot configure it through `agentcore.json` or any `agentcore add gateway` flag today.

The schema in `src/schema/schemas/mcp.ts` (`AgentCoreGatewaySchema`) defines `name`, `authorizerType`, `authorizerConfiguration`, `enableSemanticSearch`, `exceptionLevel`, `policyEngineConfiguration`, `executionRoleArn`, `tags` — but no `kmsKeyArn`. Likewise, the L3 construct at `@aws/agentcore-cdk` (`src/cdk/constructs/components/mcp/Gateway.ts`) does not pass `KmsKeyArn` through to the underlying `CfnGateway`.

This is the Gateway counterpart to the existing CMK plumbing on `Evaluator` (`agentcore-project.ts:228`).

### Acceptance Criteria

- [ ] Add `kmsKeyArn` (optional string, KMS key ARN) to `AgentCoreGatewaySchema` in `src/schema/schemas/mcp.ts`.
- [ ] Add `--kms-key-arn` flag to `agentcore add gateway` in `GatewayPrimitive.ts`.
- [ ] Surface `KMS Key ARN (optional)` in the gateway TUI wizard at `src/cli/tui/screens/mcp/AddGatewayFlow.tsx`.
- [ ] Wire the field through to `CfnGateway.KmsKeyArn` in the L3 construct (`@aws/agentcore-cdk` — `src/cdk/constructs/components/mcp/Gateway.ts`).
- [ ] Validate ARN format using the same partition-aware logic as the rest of the CLI (`src/cli/aws/partition.ts`).
- [ ] Snapshot tests updated; no regression on default (no-CMK) gateway deploys.

### Additional Context

- CFN support: **YES** — `Gateway.KmsKeyArn` ([docs](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-gateway.html)).
- L3 gap: yes — needs corresponding PR to `aws/agentcore-l3-cdk-constructs`.
- Related: KMS plumbing already exists for Evaluator (`EvaluatorPrimitive.ts`) — same shape can be reused.