MasterKeyProvider implementation for opendcb-data-protection backed by AWS KMS (Encrypt/ Decrypt operations against a configured CMK). Managed, lower operational burden than self-hosting Vault; has a Mumbai (ap-south-1) region for RBI-style data-localization requirements without cross-border key material transfer. Depends only on opendcb-data-protection's MasterKeyProvider interface and the AWS SDK for KMS; changes nothing in opendcb-data-protection ...