The hidden trap in Terraform's S3 backend (and why Cloudflare breaks it)

Why terraform init threw SignatureDoesNotMatch through Cloudflare Tunnels, and what AWS SDK v2 is doing behind the scenes.