Correct B2 application key guidance: use "All" bucket access, not one bucket

Confirmed live and cross-checked against a real, documented Kopia issue
(kopia/kopia#5329): the walkthrough previously told the operator to scope
the Application Key to just the bucket they created — the more
security-conservative default, and correct for B2's own S3-compatible
API in general. But Kopia specifically needs the listBuckets capability
even though it only ever touches the one configured bucket, and B2's
basic "Add a New Application Key" web form doesn't expose a way to grant
listBuckets on a bucket-restricted key — only an account-wide ("All")
key gets it through that form. Without it, the connection fails with
B2's unhelpful "Cannot access bucket" error, which doesn't point at the
actual missing capability at all.

Updated the guidance to "All" with the reasoning inline, and a note that
single-bucket scoping is still possible for anyone willing to create the
key via B2's CLI/API directly (b2_create_key with an explicit
capabilities list including listBuckets) rather than the basic web form
this walkthrough is written for.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4k6J1qXXyYxhGEgnJaMvn

services/backup.sh

@@ -727,7 +727,13 @@ install_backup() {
         echo "         e.g. s3.us-west-004.backblazeb2.com — you'll need it below."
         echo ""
         echo "  2) Account → App Keys → Add a New Application Key"
-        echo "       - Allow access to: the bucket you just created (not 'All')"
+        echo "       - Allow access to: All — confirmed live (kopia/kopia issue #5329): a key"
+        echo "         restricted to one bucket via this basic form doesn't get the"
+        echo "         'listBuckets' capability Kopia needs even though it only ever touches"
+        echo "         that one bucket, and B2 fails the connection with an unhelpful 'Cannot"
+        echo "         access bucket' error. Restricting to one bucket only works if you add"
+        echo "         listBuckets via the B2 CLI/API's own key-creation call instead of this"
+        echo "         form — not something this walkthrough covers."
         echo "       - Type: Read and Write"
         echo "       - B2 shows the application key ONLY once — copy both values now,"
         echo "         you can't retrieve the key itself again afterward."