fix: publish declarations from @aligent/cdk-secure-rest-api

[toddhainsworth]

Summary

• @aligent/cdk-secure-rest-api@1.1.0 shipped without .d.ts files because the package had no .npmignore, so npm pack fell back to the workspace .gitignore (which excludes build outputs).
• Consumers with isolatedModules: true resolved index.ts directly and hit TS1205 on the type re-exports.
• TS-aware loaders like tsx additionally preferred the shipped .ts source over index.js, causing SecureRestApi is not a constructor at runtime in ESM consumers.

Changes

• Add packages/constructs/secure-rest-api/.npmignore matching sibling packages — excludes *.ts source / tests / configs while preserving *.d.ts declarations.
• Split index.ts into a value re-export (SecureRestApi) and export type re-export (SecureRestApiProps, SecureRestApiRoute) — defends against any future scenario where consumers resolve the source again.
• Add a patch changeset.

Verified locally with npm pack --dry-run: tarball is now 7 files (down from 13), no .ts source, includes both index.d.ts and lib/secure-rest-api.d.ts.

Test plan

• yarn nx lint secure-rest-api passes
• yarn nx build secure-rest-api produces index.d.ts + lib/secure-rest-api.d.ts
• yarn nx test secure-rest-api passes (12/12)
• npm pack --dry-run lists *.d.ts and excludes *.ts source, test, and config files
• After publish to 1.1.1, consumer-side .yarn/patch for this package can be removed

Follow-ups (not in this PR)

• prerender-fargate is missing .npmignore for the same reason — likely has the same bug in its published tarball.
• Type re-export hygiene (export type) is missing across most packages — currently masked by .d.ts shipping correctly, but worth a sweep.
• Consider a CI guard (npm pack --dry-run | grep -q '\.d\.ts') to catch this class of regression before publish.