The state bucket is created outside the main project, via its own local-backend Terraform config - this avoids the chicken-and-egg problem of needing a backend to store the state of the thing that creates the backend.

cd bootstrap
terraform init
terraform plan
terraform apply

Expect: 4 resources created (S3 bucket, versioning, encryption, public access block).

IAM checkpoint: your deployer identity needs an S3-scoped policy (bucket create/read/write, plus the various Get* reads Terraform performs on refresh) before this will succeed. Scope Resource to the specific bucket ARN, not *.