Backend now lives in s3://devfest-omsk-tfstate so multiple organizers
share a single source of truth. Makefile maps YC_S3_* from .env to
AWS_ACCESS_KEY_ID/SECRET for plan/deploy. tfstate bucket is managed in
tfstate.tf; versioning is enabled out-of-band with `yc storage bucket
update --versioning enabled` since cdn_sa is intentionally kept at
storage.editor.