feat(flex): allow opting into PITR for the transient locks table

[psg2]

Summary

• add locks_table_point_in_time_recovery_enabled to the public Flex module
• preserve the existing behavior with a false default
• wire the opt-in to the transient locks DynamoDB table
• add plan coverage for both the default and enabled configurations
• regenerate the affected module documentation

Motivation

Some organizations require point-in-time recovery on every active DynamoDB table for backup and compliance controls. I saw the decision on #41 to keep PITR disabled for the transient locks table, so this PR does not change that default and does not add a switch for tables that already have PITR permanently enabled. It only lets callers explicitly opt in when their policy requires it.

Validation

• make test-plan-tofu — all OpenTofu module tests passed
• tofu test -filter=tests/plan_behavior.tofutest.hcl in modules/control_plane/flex — 20 passed
• tofu test -filter=tests/root.tftest.hcl in modules/flex — 26 passed
• tofu fmt -check -recursive

make test-plan-source cannot run completely from this exported repository because several TestPlanSource* cases reference monorepo-only paths that are not published here (cloudformation/, stacks/, .github/workflows/, and agent source). The structured Terraform plan tests and resource-count tests completed successfully.