High-level Route 53 Hosted Zone builder following AWS best practices. **Default Settings:** - Query logging = disabled (opt-in via logging operation) - DNSSEC = disabled (opt-in, requires KMS key) **Rationale:** Hosted zones manage DNS records for your domain. DNSSEC and logging are opt-in features with additional costs. **Escape Hatch:** Access the underlying CDK HostedZone via the `HostedZone` property for advanced scenarios not covered by this builder.