Provider of B2 runtime config and authorize responses.
Optional key and user-agent overrides.
Lazy S3 client facade used by tool registrars.
B2 authorize returns the account's S3 API URL. This facade builds the real S3
client from that endpoint on first operation, shares the in-flight authorize
call, and falls back to the configured region for an authorize outage such as
invalid credentials or a timeout. That fallback is a compatibility path, not a
fail-closed check; the first S3 operation then surfaces any credential failure
from the S3 API itself. An authorized endpoint outside the trusted B2 host set
is the exception: it is a deliberate untrusted_endpoint/502 refusal and is
re-thrown rather than masked by the fallback.
Create a lazy S3 facade that authorizes B2 before first use.