High-level API Gateway V2 HTTP API builder following AWS best practices. **Default Security Settings:** - CORS = disabled (opt-in for specific origins) - Auto-deploy = true **Rationale:** These defaults follow AWS Well-Architected Framework: - CORS disabled by default prevents unauthorized cross-origin access - HTTP API provides low-latency, cost-effective API Gateway - Auto-deploy simplifies deployment workflow **Escape Hatch:** Access the underlying CDK HttpApi via the `Api` property for advanced scenarios not covered by this builder.