Add two-stage ECR lifecycle policy (expire then delete)

## User Story
As a user,
I want ECR images to be retained for a grace period before permanent deletion,
so that systems which have not yet been upgraded are not immediately broken by lifecycle actions.

## Description / Background
Currently, the ECR lifecycle policy permanently deletes images older than 1 year.
If a user has not upgraded their system in time, this can cause the service to stop working.
To reduce this risk, a two-stage lifecycle policy is required:
- Images older than 1 year should first be expired.
- Expired images should only be permanently deleted after an additional 90 days.
This provides a grace period in which issues caused by lifecycle expiry can be identified and remediated before irreversible deletion occurs.

## Acceptance Criteria
Scenario: ECR images are expired after 1 year
Given an ECR repository
When the repository is deployed
Then an ECR lifecycle policy exists that expires images older than 365 days

Scenario: Expired ECR images are deleted after 90 days
Given an ECR repository with expired images
When an image has been expired for 90 days
Then the lifecycle policy permanently deletes the image

Scenario: Recent ECR images are not expired
Given an ECR repository
When the repository is deployed
Then images newer than 365 days are not expired by the lifecycle policy

## Technical Notes / Implementation Details
- The preferred implementation is to use AWS CDK once native support for the required ECR lifecycle policy actions is available.
- As a workaround, this could be implemented using lower-level CfnResource constructs, defining the lifecycle policy directly as JSON rather than using LifecycleRule.builder().
Reference:
AWS ECR Lifecycle Policy Parameters – https://docs.aws.amazon.com/AmazonECR/latest/userguide/lifecycle_policy_parameters.html#lp_action

- https://github.com/aws/aws-cdk/issues/36824

## Dependencies / Blockers
- AWS CDK needs to be updated to support the required ECR lifecycle policy actions via higher-level constructs.
- This support is expected in Q1 2026.
-
## Notes
- ECR does not support a true “archive” or restore state; images are first expired and later permanently deleted.
- Acceptance criteria intentionally use ECR terminology (expire, delete) to match actual service behaviour.