A tiny, zero-dependency S3 client: signs each request with SigV4 and sends it
over the JDK's `java.net.http` client. It is path-style and stateless — just
the transport R2 needs, with no per-operation knowledge baked in.

AWS Signature Version 4 signing, pared down to what R2 needs.

Header-based authorization (not presigned query strings), SHA-256 payload
hashing, path-style URLs. No chunked/streaming signature. The crypto is all
JDK-native (`java.security`, `javax.crypto`), so this carries no dependency.

`sign` is pure — timestamps are passed in rather than read from the clock —
which lets it be checked against AWS's published test vectors.

Just enough XML to talk to S3: pull a tag's text out of a small response
document and build the CompleteMultipartUpload request body.

This is deliberately *not* a general XML library. The documents S3 returns
for the handful of operations we use are small, flat, and machine-generated,
so a tag scan is enough and avoids a parser dependency.