fix: auto-generate unique S3 state bucket name using AWS account ID

[cstirry]

Problem

When a new deployer runs uv run opencontext authenticate, all checks pass cleanly — Python, uv, AWS CLI, credentials, and Terraform. But then when they run uv run opencontext configure and complete the CLI wizard, it fails at the end with no useful explanation:

Error: An error occurred (403) when calling the HeadBucket operation: Forbidden

The root cause is that the S3 bucket name for Terraform state was hardcoded to opencontext-terraform-state in multiple places. S3 bucket names are globally unique across all AWS accounts — this name is already owned by another account, so any new deployer hits a 403 with no actionable error message.

There were three separate issues discovered while fixing this:

---

Fixes

1. Auto-generate a unique S3 bucket name using the AWS account ID

Instead of a hardcoded bucket name, the CLI now calls STS to get the deployer's AWS account ID and generates a name in the format opencontext-terraform-state-<account-id> (e.g. opencontext-terraform-state-716692883178). This is guaranteed unique per AWS account with no extra user input required. Users can still override it with --state-bucket if needed.

Files changed: cli/commands/configure.py, terraform/bootstrap/variables.tf, terraform/bootstrap/main.tf

2. Handle 403 with a clear error message instead of crashing

Previously, if a 403 was encountered (bucket owned by another account), the raw AWS ClientError bubbled up to Rich's console.print which tried to parse the AWS error text as Rich markup. The error message contains [/:] which caused a secondary MarkupError crash, completely obscuring the real problem. The 403 is now caught explicitly and prints a clear, actionable message:

Bucket <name> exists but is owned by another AWS account.
Use --state-bucket to specify a unique name.

File changed: cli/commands/configure.py

3. Always run terraform init -reconfigure instead of skipping if .terraform exists

The original code skipped terraform init if a .terraform directory already existed. This caused a second failure on re-runs after the bucket name changed — Terraform detected a backend config change and refused to proceed without reinitialization. Removing the existence check and adding -reconfigure ensures the backend config is always in sync.

File changed: cli/commands/configure.py

---

How to reproduce the original bug

1. Clone the repo fresh into a new AWS account
2. Run uv run opencontext authenticate — all checks pass
3. Run uv run opencontext configure and complete the wizard
4. Observe the 403 error with no explanation at the end

How to verify the fix

1. Apply this PR
2. Run uv run opencontext configure and complete the wizard
3. Observe the bucket is created as opencontext-terraform-state-<your-account-id>
4. Configuration completes successfully and prints the summary table