test(coverage/r2): drive storageprovider/r2 to ≥95% (was 92.0%)

Adds r2_coverage_test.go covering uncovered branches: Name(), accessor
methods (MasterAccessKey/MasterSecretKey/Endpoint/Bucket/PublicURL), New()
master-key validation + endpoint/bucket defaults, apiBase() default branch,
IssueTenantCredentials empty-prefix fallback + bucket override + trailing
slash stripping, issueLongLivedKey HTTP error / invalid JSON / success=false
/ transport error, issueTempCreds HTTP error / invalid JSON / success=false
/ unparseable expiry / empty expiry / transport error, RevokeTenantCredentials
HTTP error / 404 idempotency / transport error, customerEndpointURL public-URL
+ scheme-already-present branches, plus init() registration via storageprovider.Factory.

Coverage: 69.6% → 95.5%. Remaining uncovered statements are defensive
json.Marshal / http.NewRequestWithContext failure paths that aren't
reachable without injecting a broken stdlib.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mastermanas805