backend/remote: clearer error when org read fails

When we fail to read the organization entitlements, it's not
always because the organization doesn't exist; in practice, it's
usually due to a misspelled organization name, forgetting to
specify the correct hostname, or an invalid API token. Surfacing
more information within the error message will help new users
debug these issues more effectively.

backend/remote/backend.go

@@ -321,15 +321,16 @@ func (b *Remote) Configure(obj cty.Value) tfdiags.Diagnostics {
 	entitlements, err := b.client.Organizations.Entitlements(context.Background(), b.organization)
 	if err != nil {
 		if err == tfe.ErrResourceNotFound {
-			err = fmt.Errorf("organization %s does not exist", b.organization)
+			err = fmt.Errorf("organization %q at host %s not found.\n\n"+
+				"Please ensure that the organization and hostname are correct "+
+				"and that your API token for %s is valid.",
+				b.organization, b.hostname, b.hostname)
 		}
 		diags = diags.Append(tfdiags.AttributeValue(
 			tfdiags.Error,
-			"Failed to read organization entitlements",
-			fmt.Sprintf(
-				`The "remote" backend encountered an unexpected error while reading the `+
-					`organization settings: %s.`, err,
-			),
+			fmt.Sprintf("Failed to read organization %q at host %s", b.organization, b.hostname),
+			fmt.Sprintf("The \"remote\" backend encountered an unexpected error while reading the "+
+				"organization settings: %s", err),
 			cty.Path{cty.GetAttrStep{Name: "organization"}},
 		))
 		return diags

backend/remote/backend_test.go

@@ -55,7 +55,7 @@ func TestRemote_config(t *testing.T) {
 					"prefix": cty.NullVal(cty.String),
 				}),
 			}),
-			confErr: "organization nonexisting does not exist",
+			confErr: "organization \"nonexisting\" at host app.terraform.io not found",
 		},
 		"with_an_unknown_host": {
 			config: cty.ObjectVal(map[string]cty.Value{