✨ Support userIdentity filtering for TTL-only audit archival

Summary

Add an optional flag to filter audit archival to only TTL-deleted records, excluding manual deletions.

Background

Issue #77 archives all REMOVE events for AUDIT# keys. In real AWS, TTL deletions include a userIdentity field that distinguishes them from manual API deletions:

"userIdentity": {
  "principalId": "dynamodb.amazonaws.com",
  "type": "Service"
}

Some organizations may want to only archive TTL-expired records, not manually deleted ones.

Why v0.8.0?

LocalStack does not include the userIdentity field in stream records. This feature cannot be tested in LocalStack and requires AWS E2E tests (#189) to be in CI first.

Proposed Implementation

Configuration

# In StackOptions
audit_archive_ttl_only: bool = False  # Only archive TTL deletions

CLI

zae-limiter deploy --name my-app \
  --audit-archive-bucket my-bucket \
  --audit-archive-ttl-only

Lambda Logic

def should_archive(record: dict, ttl_only: bool) -> bool:
    if record["eventName"] != "REMOVE":
        return False
    if not record["dynamodb"]["Keys"]["PK"]["S"].startswith("AUDIT#"):
        return False
    if ttl_only:
        user_identity = record.get("userIdentity", {})
        if user_identity.get("principalId") != "dynamodb.amazonaws.com":
            return False
    return True

Testing

• Unit tests: Mock stream records with userIdentity field
• AWS E2E tests: Verify filtering with real TTL deletions (requires #189)

Related

• #77 - Base audit archive implementation (prerequisite)
• #189 - AWS E2E in CI (prerequisite for testing)

Start by tracing StackOptions, the zae-limiter deploy CLI entry point, and the proposed should_archive Lambda logic. Add the optional TTL-only setting and CLI flag, cover mocked userIdentity records in unit tests, and verify AWS TTL filtering once prerequisite issue #189 enables E2E coverage.