chore: converge stale TODOs and apply safe fills (backlog#646) (#4322)

Second TODO-convergence round over the current tree (backlog#646). All
line numbers in the old inventory had gone stale after the set_disk /
diagnostics / cluster refactors, so this re-scans and reduces the marker
count from 144 to 99.

STALE removals (comment describes already-implemented behavior, or dead
commented-out blocks) across ecstore (set_disk ops/core, store,
cluster/rpc, bucket/metadata_sys, services), iam, filemeta, s3select and
rustfs auth/object_usecase. No behavior change.

Safe fills, each verified:
- filemeta: replication_info_equals now also compares
  replication_state_internal (function currently has no callers; adds a
  regression test).
- bitrot: drop the confirmed-unused `_want` parameter from bitrot_verify
  and the now-unused `sum` on LocalDisk::bitrot_verify, removing a
  Bytes::copy_from_slice allocation. Streaming verify uses the file's
  embedded per-shard hash, never the passed sum.
- signer: rename v4_ignored_headers -> V4_IGNORED_HEADERS and drop the
  non_upper_case_globals allow.
- admin/heal: test_decode was #[ignore]d and used serde_urlencoded on a
  JSON body (would panic); rewire to serde_json::from_slice to match the
  production decode path, add assertions, un-ignore.

Verified: cargo fmt; cargo check on touched crates; tests pass
(filemeta, signer, bitrot, heal::test_decode); arch guardrail scripts
pass.

crates/iam/src/store/object.rs

@@ -355,10 +355,6 @@ impl ObjectStore {
     async fn list_iam_config_items(&self, prefix: &str, ctx: CancellationToken, sender: Sender<StringOrErr>) {
         // debug!("list iam config items, prefix: {}", &prefix);
 
-        // TODO: Implement walk, use walk
-
-        // let prefix = format!("{}{}", prefix, item);
-
         let store = self.object_api.clone();
 
         let (tx, mut rx) = mpsc::channel::<ObjectInfoOrErr>(100);
@@ -595,42 +591,6 @@ impl ObjectStore {
             Err(e) => Err(e.into()),
         }
     }
-
-    // async fn load_policy(&self, name: &str) -> Result<PolicyDoc> {
-    //     let mut policy = self
-    //         .load_iam_config::<PolicyDoc>(&format!("config/iam/policies/{name}/policy.json"))
-    //         .await?;
-
-    //     // FIXME:
-    //     // if policy.version == 0 {
-    //     //     policy.create_date = object.mod_time;
-    //     //     policy.update_date = object.mod_time;
-    //     // }
-
-    //     Ok(policy)
-    // }
-
-    // async fn load_user_identity(&self, user_type: UserType, name: &str) -> Result<Option<UserIdentity>> {
-    //     let mut user = self
-    //         .load_iam_config::<UserIdentity>(&format!(
-    //             "config/iam/{base}{name}/identity.json",
-    //             base = user_type.prefix(),
-    //             name = name
-    //         ))
-    //         .await?;
-
-    //     if user.credentials.is_expired() {
-    //         return Ok(None);
-    //     }
-
-    //     if user.credentials.access_key.is_empty() {
-    //         user.credentials.access_key = name.to_owned();
-    //     }
-
-    //     // todo, validate session token
-
-    //     Ok(Some(user))
-    // }
 }
 
 #[async_trait::async_trait]