Fix two misleading claims in the sns_topic_kms_key_arn docs

[hostmaster]

Summary

Follow-up to #9. Code review caught two doc gaps:

1. failover.tf grants the failover Lambda's role kms:GenerateDataKey*/kms:Decrypt via IAM policy, but KMS key policies take precedence over IAM policies -- confirmed against AWS's KMS key-policy docs: "Unless the key policy explicitly allows it, you cannot use IAM policies to allow access to a KMS key... Without permission from the key policy, IAM policies that allow permissions have no effect." A restrictive customer-managed key policy that doesn't name this role or retain the default IAM-delegation statement leaves sns:Publish failing with KMSAccessDeniedException regardless of the IAM grant. The docs previously implied the IAM grant alone was sufficient.
2. "has no effect if the topic uses the default alias/aws/sns key" was misleading: AWS's SNS KMS docs require a customer-managed key for any AWS service (CloudWatch, Auto Scaling) to publish to an encrypted SNS topic at all -- so the Spot-fallback alarm, backstop alarms, and ASG notification cannot use the default key regardless of this variable. Only the Lambda's own publish works with either key type.

Both constraints are now documented explicitly in the sns_topic_kms_key_arn README row and the failover.tf comment.

Test plan

• terraform fmt -recursive -check -diff (clean)
• terraform validate (module root and examples/basic)