audit fixes: error handling, docs consistency, bucket idempotency

USECASES.md

@@ -1,5 +1,19 @@
 # Use Cases
 
+## 0. Initial Bitwarden Secrets Manager setup
+
+One-time setup before anything else works. Create the secrets project and
+machine accounts in Bitwarden Secrets Manager.
+
+1. Create a Bitwarden organization (free tier)
+2. Enable Secrets Manager for the organization
+3. Create a project named `hantim`
+4. Create all required secrets (see README.md Secrets table for the full list)
+5. Create machine accounts:
+   - `hantim-server` — grant access to the `hantim` project
+   - `hantim-ci` — reserved for future CI use
+6. Generate access tokens for each machine account
+
 ## 1. Provision a new server
 
 Set up a fresh Rocky Linux 9 server from scratch.
@@ -157,8 +171,9 @@ on each domain.
 
 ```bash
 # One-time setup
-aws configure  # key ID + secret from bws, region: garage
-aws configure set default.endpoint_url https://s3.hantim.net
+aws configure  # key ID + secret from bws, region: garage, output: json
+# Then add to ~/.aws/config under [default]:
+#   endpoint_url = https://s3.hantim.net
 
 # Upload a single file
 aws s3 cp photo.jpg s3://example.com/photo.jpg