Fix ALB listener default action, auto-import numberOfAzs, and correct docs

- Fix HTTP listener in spicy-alb.ts missing default action when no certificate
  is provided, which would cause CDK synth to fail
- Auto-import numberOfAzs from VPC stack exports (NumberOfAZs) in cluster,
  service, and ALB stacks when not provided via context
- Fix CDK_SYNTH_EXAMPLES.md ALB examples using raw vpcId/subnetIds that don't
  match the actual fromContext() implementation (requires clusterName)
- Fix docs overstating "only clusterName required" to list actual required params
- Remove package-lock.json and add to .gitignore (project uses pnpm)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

resources/lib/constructs/spicy-alb.ts

@@ -161,12 +161,6 @@ export class SpicyAlb extends Construct {
       this.loadBalancer.logAccessLogs(props.logsBucket, prefix);
     }
 
-    // HTTP Listener
-    this.httpListener = this.loadBalancer.addListener('HTTPListener', {
-      port: 80,
-      protocol: elbv2.ApplicationProtocol.HTTP,
-    });
-
     // HTTPS Listener (if certificate provided)
     if (props.certificateArn) {
       this.httpsListener = this.loadBalancer.addListener('HTTPSListener', {
@@ -178,17 +172,28 @@ export class SpicyAlb extends Construct {
           messageBody: 'No target groups configured',
         }),
       });
+    }
 
-      // HTTP→HTTPS redirect (if enabled, default true)
-      if (props.redirectHttpToHttps !== false) {
-        this.httpListener.addAction('RedirectToHTTPS', {
-          action: elbv2.ListenerAction.redirect({
-            protocol: 'HTTPS',
-            port: '443',
-            permanent: true,
-          }),
-        });
-      }
+    // HTTP Listener - redirect to HTTPS if certificate provided, otherwise serve as primary
+    if (props.certificateArn && props.redirectHttpToHttps !== false) {
+      this.httpListener = this.loadBalancer.addListener('HTTPListener', {
+        port: 80,
+        protocol: elbv2.ApplicationProtocol.HTTP,
+        defaultAction: elbv2.ListenerAction.redirect({
+          protocol: 'HTTPS',
+          port: '443',
+          permanent: true,
+        }),
+      });
+    } else {
+      this.httpListener = this.loadBalancer.addListener('HTTPListener', {
+        port: 80,
+        protocol: elbv2.ApplicationProtocol.HTTP,
+        defaultAction: elbv2.ListenerAction.fixedResponse(404, {
+          contentType: 'text/plain',
+          messageBody: 'No target groups configured',
+        }),
+      });
     }
 
     // Blue/Green DNS configuration