List and query object storage buckets

Returns the paginated collection of object storage buckets in the active tenant → subscription → project scope, as the console's bucket list shows it: name with default storage class and encryption mode, visibility (Private or Public; a legacy bucket may still report Authenticated, which is effectively private), object count, total size in bytes, region and creation time. This single endpoint serves both the plain route-load listing and the interactive search/filter/sort/pagination controls: q performs a case-insensitive substring match on the bucket name, the visibility filter and versioned flag mirror the "Public" and "Versioned" counter chips. sort and order are not applied: buckets are always returned oldest first (by creation time). No resource state is mutated. Validation: scopeId must reference a scope the caller can read (unknown → 404 NOT_FOUND); visibility must be one of Private|Public|Authenticated, page must be a positive integer and pageSize 1–200 (invalid → 422 VALIDATION_FAILED); caller must hold reader-or-higher RBAC on the scope, otherwise 403 FORBIDDEN. Async & state: Synchronous read; no state change. Subsequent bucket changes (object count and size drift, visibility flips, deletion) arrive as resource.updated SSE frames (kind storage.bucket, patch {objectCount, sizeBytes, visibility, versioning}). Errors: 401 missing/expired session; 403 caller lacks read access to the scope; 404 unknown scopeId; 422 malformed query parameters; 500 unexpected backend failure. Idempotency/Concurrency: Safe, cacheable; no idempotency key required. Soft-deleted buckets are always excluded (WHERE deleted_at IS NULL).