chore: converge stale TODOs and apply safe fills (backlog#646) (#4322)

Second TODO-convergence round over the current tree (backlog#646). All
line numbers in the old inventory had gone stale after the set_disk /
diagnostics / cluster refactors, so this re-scans and reduces the marker
count from 144 to 99.

STALE removals (comment describes already-implemented behavior, or dead
commented-out blocks) across ecstore (set_disk ops/core, store,
cluster/rpc, bucket/metadata_sys, services), iam, filemeta, s3select and
rustfs auth/object_usecase. No behavior change.

Safe fills, each verified:
- filemeta: replication_info_equals now also compares
  replication_state_internal (function currently has no callers; adds a
  regression test).
- bitrot: drop the confirmed-unused `_want` parameter from bitrot_verify
  and the now-unused `sum` on LocalDisk::bitrot_verify, removing a
  Bytes::copy_from_slice allocation. Streaming verify uses the file's
  embedded per-shard hash, never the passed sum.
- signer: rename v4_ignored_headers -> V4_IGNORED_HEADERS and drop the
  non_upper_case_globals allow.
- admin/heal: test_decode was #[ignore]d and used serde_urlencoded on a
  JSON body (would panic); rewire to serde_json::from_slice to match the
  production decode path, add assertions, un-ignore.

Verified: cargo fmt; cargo check on touched crates; tests pass
(filemeta, signer, bitrot, heal::test_decode); arch guardrail scripts
pass.

rustfs/src/admin/handlers/heal.rs

@@ -1153,12 +1153,21 @@ mod tests {
         assert!(err.to_string().contains("invalid bucket name"));
     }
 
-    #[ignore] // FIXME: failed in github actions - keeping original test
     #[test]
     fn test_decode() {
+        // Mirror the production decode path (handler decodes the request body via
+        // serde_json::from_slice), not urlencoded.
         let b = b"{\"recursive\":false,\"dryRun\":false,\"remove\":false,\"recreate\":false,\"scanMode\":1,\"updateParity\":false,\"nolock\":false}";
-        let s: HealOpts = serde_urlencoded::from_bytes(b).unwrap();
-        debug!("Parsed HealOpts: {:?}", s);
+        let s: HealOpts = serde_json::from_slice(b).expect("HealOpts JSON body must decode");
+        assert!(!s.recursive);
+        assert!(!s.dry_run);
+        assert!(!s.remove);
+        assert!(!s.recreate);
+        assert_eq!(s.scan_mode, HealScanMode::Normal);
+        assert!(!s.update_parity);
+        assert!(!s.no_lock);
+        assert_eq!(s.pool, None);
+        assert_eq!(s.set, None);
     }
 
     #[tokio::test]

rustfs/src/app/object_usecase.rs

@@ -5398,8 +5398,6 @@ impl DefaultObjectUsecase {
         };
         let last_modified = info.mod_time.map(Timestamp::from);
 
-        // TODO: range download
-
         let content_length = info.get_actual_size().map_err(|e| {
             error!(error = %e, "Failed to resolve actual object size");
             ApiError::from(e)

rustfs/src/auth.rs

@@ -439,8 +439,6 @@ pub fn check_claims_from_token(token: &str, cred: &Credentials) -> S3Result<Hash
         return Err(s3_error!(InternalError, "action cred not init"));
     };
 
-    // TODO: REPLICATION
-
     let (token, secret) = if cred.is_service_account() {
         (cred.session_token.as_str(), cred.secret_key.as_str())
     } else {