Create an object storage bucket

Provisions a new object storage bucket in the active scope: a globally unique DNS-compatible name, target region, visibility (private or public), object versioning, a default storage class (standard, ia or archive; saved with the bucket, it doesn't change how objects are stored or billed) and key/value tags. Lifecycle rules are NOT supported: the object store (OpenStack Swift) has no lifecycle engine, so a non-empty lifecycleRules is refused (see Validation) rather than stored and never applied. encryption is reported truthfully: AT_REST only where the region's object store encrypts at rest, else NONE; customer-managed keys are not offered. On acceptance the bucket becomes discoverable in the scoped bucket list in its transitional state. Validation: name must match ^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$ (3–63 chars, lowercase letters, numbers, dots, hyphens; alphanumeric at both ends) and be globally unique (taken → 409 CONFLICT); region must be an offered, generally-available region (unknown or coming-soon → 422 VALIDATION_FAILED); objectLock: true → 422 VALIDATION_FAILED with field: objectLock and details.reason: object_lock_not_supported (: the object store cannot enforce object lock against the project's own credentials, so no new bucket can enable it); a non-empty lifecycleRules → 422 VALIDATION_FAILED with field: lifecycleRules and details.reason: lifecycle_not_supported (an empty array is accepted); the subscription bucket quota must not be exhausted (→ 409 QUOTA_EXCEEDED); caller must hold owner|admin|contributor on the scope, otherwise 403 FORBIDDEN. Async & state: Asynchronous — returns 202 with the Bucket resource in its transitional creating state, transitioning creating → active (or → failed on provisioning error). Progress is emitted as resource.updated SSE frames (kind storage.bucket, patch {status, objectCount, sizeBytes}) until the bucket is serving requests. Errors: 401 unauthenticated; 403 caller lacks create permission on the scope; 404 unknown scopeId; 409 CONFLICT bucket name already taken globally; 409 QUOTA_EXCEEDED bucket quota for the subscription exhausted; 409 CAPACITY_UNAVAILABLE selected region cannot accept new buckets; 422 invalid name, region, unsupported lifecycle rules or object-lock combination; 500 unexpected backend failure. Idempotency/Concurrency: Idempotency-Key is required; replaying the same key returns the original 202 response without creating a duplicate bucket (duplicate creation under a globally unique namespace would be harmful).