High-level Kinesis Stream builder following AWS best practices. **Default Security Settings:** - Encryption = enabled with AWS managed key - Retention period = 24 hours - Shard count = 1 (for low throughput) - Stream mode = PROVISIONED **Rationale:** These defaults follow AWS Well-Architected Framework: - Encryption at rest for data protection - 24-hour retention balances cost and recovery needs - Single shard for cost optimization (scale as needed) - Provisioned mode for predictable costs **Escape Hatch:** Access the underlying CDK Stream via the `Stream` property for advanced scenarios not covered by this builder.