chore: converge stale TODOs and apply safe fills (backlog#646) (#4322)

Second TODO-convergence round over the current tree (backlog#646). All
line numbers in the old inventory had gone stale after the set_disk /
diagnostics / cluster refactors, so this re-scans and reduces the marker
count from 144 to 99.

STALE removals (comment describes already-implemented behavior, or dead
commented-out blocks) across ecstore (set_disk ops/core, store,
cluster/rpc, bucket/metadata_sys, services), iam, filemeta, s3select and
rustfs auth/object_usecase. No behavior change.

Safe fills, each verified:
- filemeta: replication_info_equals now also compares
  replication_state_internal (function currently has no callers; adds a
  regression test).
- bitrot: drop the confirmed-unused `_want` parameter from bitrot_verify
  and the now-unused `sum` on LocalDisk::bitrot_verify, removing a
  Bytes::copy_from_slice allocation. Streaming verify uses the file's
  embedded per-shard hash, never the passed sum.
- signer: rename v4_ignored_headers -> V4_IGNORED_HEADERS and drop the
  non_upper_case_globals allow.
- admin/heal: test_decode was #[ignore]d and used serde_urlencoded on a
  JSON body (would panic); rewire to serde_json::from_slice to match the
  production decode path, add assertions, un-ignore.

Verified: cargo fmt; cargo check on touched crates; tests pass
(filemeta, signer, bitrot, heal::test_decode); arch guardrail scripts
pass.

crates/ecstore/src/disk/local.rs

@@ -1785,14 +1785,7 @@ impl LocalDisk {
         DiskMetrics::default()
     }
 
-    async fn bitrot_verify(
-        &self,
-        part_path: &PathBuf,
-        part_size: usize,
-        algo: HashAlgorithm,
-        sum: &[u8],
-        shard_size: usize,
-    ) -> Result<()> {
+    async fn bitrot_verify(&self, part_path: &PathBuf, part_size: usize, algo: HashAlgorithm, shard_size: usize) -> Result<()> {
         let retry_count = bitrot_size_mismatch_retry_count();
         let retry_delay = bitrot_size_mismatch_retry_delay();
 
@@ -1801,16 +1794,7 @@ impl LocalDisk {
             let meta = file.metadata().await.map_err(to_file_error)?;
             let file_size = meta.len() as usize;
 
-            match bitrot_verify(
-                Box::new(file),
-                file_size,
-                part_size,
-                algo.clone(),
-                Bytes::copy_from_slice(sum),
-                shard_size,
-            )
-            .await
-            {
+            match bitrot_verify(Box::new(file), file_size, part_size, algo.clone(), shard_size).await {
                 Ok(()) => return Ok(()),
                 Err(err) if attempt < retry_count && is_bitrot_size_mismatch_error(&err) => {
                     info!(
@@ -2622,7 +2606,6 @@ impl DiskAPI for LocalDisk {
                     &part_path,
                     erasure.shard_file_size(part.size as i64) as usize,
                     checksum_algo,
-                    &checksum_info.hash,
                     erasure.shard_size(),
                 )
                 .await