test: improve coverage for utils, SyncConfig, and Waf

[sid88in]

Pure test additions (no production code changed).

• 248 → 287 tests
• Branches: 73.25% → 75.67% (+2.42%)
• SyncConfig: 92% → 100% on every metric
• Waf: branches 80.7% → 87.71%
• utils: branches 75% → 95%

PR description: improve test coverage on utils, SyncConfig, and Waf

What

Targeted unit-test additions for the lowest-coverage files in the codebase.
Pure test additions — no production code changes.

Results

Metric	Before	After	Δ
Tests	248	287	+39
Statements	83.90%	84.56%	+0.66%
Branches	73.25%	75.67%	+2.42%
Functions	80.00%	82.27%	+2.27%
Lines	84.50%	85.06%	+0.56%

Per-file improvements:

File	Statements	Branches	Functions
src/resources/SyncConfig.ts	92% → 100%	50% → 100%	100%
src/resources/Waf.ts	95.55% → 98.88%	80.7% → 87.71%	80% → 93.33%
src/utils.ts	76.81% → 82.60%	75% → 95%	66.66%

What's new

src/__tests__/utils.test.ts (+26 tests)

• parseDuration: every supported time unit (y, q, M, w, d, h, m, s, ms), the number-input branch, default-to-hours behavior, and descriptive error paths
• parseDateTimeOrDuration: explicit day/week duration cases
• getHostedZoneName / getWildCardDomainName: two-part and deep-subdomain edge cases
• toCfnKeys (previously untested): top-level capitalization, recursion, idempotency on already-capitalized keys, primitive scalars
• wait: fake-timer-driven verification

src/__tests__/syncConfig.test.ts (new file, 6 tests)

• Returns undefined when no sync block is present
• Defaults VERSION + OPTIMISTIC_CONCURRENCY when sync is enabled with no fields set
• NONE conflict detection short-circuits (no handler emitted)
• LAMBDA handler with explicit functionArn
• LAMBDA handler with inline function definition
• AUTOMERGE handler

src/__tests__/waf.test.ts (+7 tests in a new "Edge cases" group)

• Object-shaped defaultAction (not just 'Allow' | 'Block')
• Fallback Waf name derived from API name (${apiName}Waf)
• Fallback description text
• enabled: false short-circuits even when rules are present
• Missing rules array doesn't crash
• Explicit rule priority is preserved (vs auto-incrementing)
• Auto-incrementing priorities start at 100

Notes for reviewers

A few tests document existing quirks rather than introduce assertions about
ideal behavior, with explanatory comments inline:

• toCfnKeys({ value: null }) returns { Value: {} } because the isRecord
  helper relies on typeof null === 'object'. Pinned down so any future
  refactor of isRecord is intentional.
• Luxon normalizes quarters into months (1q → P3M).
• The 1year / 1years regex branch in parseDuration is unreachable
  via the outer regex — only 1y ever hits the auto-fix path. Documented
  via test omission and an inline comment in the code, not "fixed", since
  that would be a behavior change inappropriate for a test-only PR.

Verification

• ✅ npm test — 287/287 passing
• ✅ npm run lint — clean
• ✅ npm run build — clean
• ✅ npx jest --coverage confirms numbers above

Not in scope

• src/index.ts (67% statements, ~33% uncovered) — the uncovered code is the
  AWS CLI command handlers that talk to AppSync/CloudFormation/CloudWatch.
  Bringing those to high coverage requires SDK mocking (probably
  aws-sdk-client-mock), which is a substantial effort better tracked
  separately.
• src/resources/Api.ts remaining ~15% — would require either expanded
  snapshot tests or refactoring; not as high-leverage as the Waf/SyncConfig
  gains in this PR.