fix(rds): enablePerformanceInsights false is ignored when other performance insight properties are set (#37287)

### Issue # (if applicable)

Closes #37051

### Reason for this change

`DatabaseInstanceFromSnapshot` (and other `DatabaseInstanceNew` subclasses) ignores an explicit `enablePerformanceInsights: false` when other Performance Insights properties are also set.

### Description of changes

Replace `||` with `??` in the PI enablement logic so that an explicit `false` is not overridden. Remove the redundant fallback on the CFn property assignment.

### Description of how you validated changes

Added a unit test for `DatabaseInstanceFromSnapshot` with `enablePerformanceInsights: false`. All existing tests pass.

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

Author: mazyu36

packages/aws-cdk-lib/aws-rds/lib/instance.ts

@@ -976,9 +976,10 @@ abstract class DatabaseInstanceNew extends DatabaseInstanceBase implements IData
     this.enableIamAuthentication = props.iamAuthentication;
 
     const enablePerformanceInsights = props.enablePerformanceInsights
-      || props.performanceInsightRetention !== undefined
-      || props.performanceInsightEncryptionKey !== undefined
-      || props.databaseInsightsMode === DatabaseInsightsMode.ADVANCED;
+      ?? (props.performanceInsightRetention !== undefined
+        || props.performanceInsightEncryptionKey !== undefined
+        || props.databaseInsightsMode === DatabaseInsightsMode.ADVANCED
+        || undefined);
 
     if (props.domain) {
       this.domainId = props.domain;
@@ -1018,7 +1019,7 @@ abstract class DatabaseInstanceNew extends DatabaseInstanceBase implements IData
       deletionProtection: defaultDeletionProtection(props.deletionProtection, props.removalPolicy),
       enableCloudwatchLogsExports: this.cloudwatchLogsExports,
       enableIamDatabaseAuthentication: Lazy.any({ produce: () => this.enableIamAuthentication }),
-      enablePerformanceInsights: enablePerformanceInsights || props.enablePerformanceInsights, // fall back to undefined if not set,
+      enablePerformanceInsights: enablePerformanceInsights,
       iops,
       monitoringInterval: props.monitoringInterval?.toSeconds(),
       monitoringRoleArn: monitoringRole?.roleRef.roleArn,

packages/aws-cdk-lib/aws-rds/test/instance.test.ts

@@ -1748,6 +1748,19 @@ describe('instance', () => {
       });
     });
 
+    test('explicitly disabling performance insights is respected', () => {
+      new rds.DatabaseInstanceFromSnapshot(stack, 'Instance', {
+        engine: rds.DatabaseInstanceEngine.mysql({ version: rds.MysqlEngineVersion.VER_8_0_19 }),
+        vpc,
+        snapshotIdentifier: 'my-snapshot',
+        enablePerformanceInsights: false,
+      });
+
+      Template.fromStack(stack).hasResourceProperties('AWS::RDS::DBInstance', {
+        EnablePerformanceInsights: false,
+      });
+    });
+
     test('throws if performance insights fields are set but performance insights is disabled', () => {
       expect(() => {
         new rds.DatabaseInstance(stack, 'Instance', {