api: explain tls handshake failures when adding r2 buckets - #14

Fixes UNB-371.

For the first few minutes after Cloudflare R2 is turned on, the account's endpoint can reject TLS handshakes because its certificate isn't being served yet. During that window, adding a bucket failed with a raw remote error: tls: handshake failure, and the same request worked a few minutes later. That's why it seemed to work on the third try.

• mapS3Error now spots that exact TLS alert and returns an invalid-input error. The message tells the user to check the endpoint URL and, for a new R2 account, to try again shortly.
• Other TLS alerts and connection errors still get the generic "Could not connect to the endpoint" message.
• The S3 storage docs now mention the delay on new R2 accounts.

Tests

• New: the handshake failure is mapped even when it's wrapped in an SDK retry error.
• New: a different TLS alert still falls through to the generic message.
• Updated: the existing URL error test now uses a plain connection-refused error.