High-level CloudWatch Log Group builder following AWS best practices. **Default Security Settings:** - Retention = 7 days (cost-effective default, change for compliance) - Removal policy = DESTROY (logs cleaned up on stack deletion) - Encryption = AWS managed key (optional customer managed key) **Rationale:** These defaults follow AWS Well-Architected Framework: - 7-day retention balances observability and cost - DESTROY removal policy prevents orphaned log groups - Encryption at rest protects sensitive log data **Escape Hatch:** Access the underlying CDK LogGroup via the `LogGroup` property for advanced scenarios not covered by this builder.