chore: converge stale TODOs and apply safe fills (backlog#646) (#4322)

Second TODO-convergence round over the current tree (backlog#646). All
line numbers in the old inventory had gone stale after the set_disk /
diagnostics / cluster refactors, so this re-scans and reduces the marker
count from 144 to 99.

STALE removals (comment describes already-implemented behavior, or dead
commented-out blocks) across ecstore (set_disk ops/core, store,
cluster/rpc, bucket/metadata_sys, services), iam, filemeta, s3select and
rustfs auth/object_usecase. No behavior change.

Safe fills, each verified:
- filemeta: replication_info_equals now also compares
  replication_state_internal (function currently has no callers; adds a
  regression test).
- bitrot: drop the confirmed-unused `_want` parameter from bitrot_verify
  and the now-unused `sum` on LocalDisk::bitrot_verify, removing a
  Bytes::copy_from_slice allocation. Streaming verify uses the file's
  embedded per-shard hash, never the passed sum.
- signer: rename v4_ignored_headers -> V4_IGNORED_HEADERS and drop the
  non_upper_case_globals allow.
- admin/heal: test_decode was #[ignore]d and used serde_urlencoded on a
  JSON body (would panic); rewire to serde_json::from_slice to match the
  production decode path, add assertions, un-ignore.

Verified: cargo fmt; cargo check on touched crates; tests pass
(filemeta, signer, bitrot, heal::test_decode); arch guardrail scripts
pass.

crates/iam/src/error.rs

@@ -286,21 +286,6 @@ pub fn is_err_no_such_service_account(err: &Error) -> bool {
     matches!(err, Error::NoSuchServiceAccount(_))
 }
 
-// pub fn clone_err(e: &Error) -> Error {
-//     if let Some(e) = e.downcast_ref::<DiskError>() {
-//         clone_disk_err(e)
-//     } else if let Some(e) = e.downcast_ref::<std::io::Error>() {
-//         if let Some(code) = e.raw_os_error() {
-//             Error::new(std::io::Error::from_raw_os_error(code))
-//         } else {
-//             Error::new(std::io::Error::new(e.kind(), e.to_string()))
-//         }
-//     } else {
-//         //TODO: Optimize other types
-//         Error::msg(e.to_string())
-//     }
-// }
-
 #[cfg(test)]
 mod tests {
     use super::*;