chore: converge stale TODOs and apply safe fills (backlog#646) (#4322)

Second TODO-convergence round over the current tree (backlog#646). All
line numbers in the old inventory had gone stale after the set_disk /
diagnostics / cluster refactors, so this re-scans and reduces the marker
count from 144 to 99.

STALE removals (comment describes already-implemented behavior, or dead
commented-out blocks) across ecstore (set_disk ops/core, store,
cluster/rpc, bucket/metadata_sys, services), iam, filemeta, s3select and
rustfs auth/object_usecase. No behavior change.

Safe fills, each verified:
- filemeta: replication_info_equals now also compares
  replication_state_internal (function currently has no callers; adds a
  regression test).
- bitrot: drop the confirmed-unused `_want` parameter from bitrot_verify
  and the now-unused `sum` on LocalDisk::bitrot_verify, removing a
  Bytes::copy_from_slice allocation. Streaming verify uses the file's
  embedded per-shard hash, never the passed sum.
- signer: rename v4_ignored_headers -> V4_IGNORED_HEADERS and drop the
  non_upper_case_globals allow.
- admin/heal: test_decode was #[ignore]d and used serde_urlencoded on a
  JSON body (would panic); rewire to serde_json::from_slice to match the
  production decode path, add assertions, un-ignore.

Verified: cargo fmt; cargo check on touched crates; tests pass
(filemeta, signer, bitrot, heal::test_decode); arch guardrail scripts
pass.

crates/ecstore/src/store/list_objects.rs

@@ -1542,12 +1542,6 @@ impl ECStore {
             .instrument(tracing::Span::current()),
         );
 
-        // let merge_res = merge_entry_channels(rx, inputs, sender.clone(), 1).await;
-
-        // TODO: cancelList
-
-        // let merge_res = merge_entry_channels(rx, inputs, sender.clone(), 1).await;
-
         let results = join_all(futures).await;
 
         let mut all_at_eof = true;
@@ -1572,10 +1566,6 @@ impl ECStore {
             return Ok(Vec::new());
         }
 
-        // merge_res?;
-
-        // TODO check cancel
-
         for err in errs.iter() {
             if let Some(err) = err {
                 if err == &Error::Unexpected {
@@ -2010,9 +2000,6 @@ async fn gather_results(
             entry.name = entry.name.replace("\\", "/");
         }
 
-        // TODO: rx.recv()
-
-        // TODO: isLatestDeletemarker
         if !opts.include_directories
             && (entry.is_dir() || (!opts.versioned && entry.is_object() && entry.is_latest_delete_marker()))
         {
@@ -2212,7 +2199,6 @@ async fn merge_entry_channels(
                         if !dir_matches {
                             // dir and object has the save name
                             if other_entry.is_dir() {
-                                // TODO: read next entry to top
                                 if !select_from(&rx, &mut in_channels, other_idx, &mut top, &mut n_done).await? {
                                     return Ok(());
                                 }

crates/ecstore/src/store/mod.rs

@@ -407,7 +407,6 @@ impl crate::storage_api_contracts::object::ObjectOperations for ECStore {
         self.handle_verify_object_integrity(bucket, object, opts).await
     }
 
-    // TODO: review
     #[instrument(skip(self))]
     async fn copy_object(
         &self,
@@ -436,7 +435,7 @@ impl crate::storage_api_contracts::object::ObjectOperations for ECStore {
     async fn delete_object(&self, bucket: &str, object: &str, opts: ObjectOptions) -> Result<ObjectInfo> {
         self.handle_delete_object(bucket, object, opts).await
     }
-    // TODO: review
+
     #[instrument(skip(self))]
     async fn delete_objects(
         &self,