endpoint defaults to AWS’s for the region; another S3-compatible service names its own,
usually with path_style. On AWS the credentials need s3:ListBucket besides the object
permissions: without it a missing file answers 403, read as a failure rather than as absent.
RFC 6266: an ASCII filename for old clients and the UTF-8 filename* (RFC 5987) beside it.
Quotes, backslashes and characters that mislead a reader are dropped from both.