Update AWS KMS comparison page (aws-kms.mdx)

[coderdan]

The AWS KMS comparison page — content/stack/reference/comparisons/aws-kms.mdx ("CipherStash vs AWS KMS") — needs an update pass.

Context

Per #32, the original ZeroKMS vs Cloud KMS page was merged into aws-kms.mdx, and its placeholder diagram (sample content) was dropped in the process. The page today is a strong SDK-ergonomics comparison (encrypt/decrypt DX, searchable/identity-aware/bulk, feature table) but has no comparison diagram and leans on developer-experience rather than the key-custody / trust-model angle.

Scope

• Add a comparison diagram illustrating ZeroKMS vs AWS KMS key custody (zero-knowledge vs AWS holding key access). Blocked on the repo's diagram-rendering decision tracked in Finish ZeroKMS vs HSM comparison + add comparison diagrams #32 (image export / mermaid / diagram component).
• Strengthen the key-management / trust-model comparison — the page currently emphasizes SDK DX; add/expand the "who can access your keys" story (true zero-knowledge vs AWS KMS key access) to match the depth of the ZeroKMS-vs-HSM page.
• Verify all code examples against the current @cipherstash/stack API (Encryption, encryptedTable/encryptedColumn, LockContext, Result pattern) — they look current, but confirm as part of the pass.
• Cross-link to the ZeroKMS vs HSM comparison and any Trust Model article that comes out of Finish ZeroKMS vs HSM comparison + add comparison diagrams #32.

Related

• Finish ZeroKMS vs HSM comparison + add comparison diagrams #32 — Finish ZeroKMS vs HSM comparison + add comparison diagrams (diagram-rendering decision applies here too)