test: prune redundant cases and add high-risk coverage across crates (#4208)

Remove or consolidate 57 test cases that cannot catch regressions
(literal-constant asserts, construct-then-assert, derived-serde
round-trips, near-duplicate env/getter matrices) in common, config,
iam, madmin, and object-capacity, keeping all wire-format and
error-path guards. Add 13 tests for previously uncovered high-risk
behavior: filemeta version-sort determinism and merge resilience to
garbage headers, zip extraction path-traversal rejection and exact
limit boundaries, JWT tampered-signature rejection, and the bytes
variant of dual-key (rustfs/minio) metadata fallback and precedence.

Test-only change; no production code touched.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

crates/crypto/src/jwt/tests.rs

@@ -92,6 +92,28 @@ fn test_jwt_decode_invalid_token_format() {
     }
 }
 
+#[test]
+fn test_jwt_decode_with_tampered_signature() {
+    let claims = json!({
+        "exp": OffsetDateTime::now_utc().unix_timestamp() + 1000,
+        "sub": "user123"
+    });
+
+    let secret = b"test_secret";
+    let jwt_token = encode(secret, &claims).expect("Failed to encode JWT");
+
+    // Flip one character in the signature segment
+    let (head, signature) = jwt_token.rsplit_once('.').expect("JWT should have a signature segment");
+    let last_char = signature.chars().last().expect("Signature should not be empty");
+    let flipped = if last_char == 'A' { 'B' } else { 'A' };
+    let mut tampered_signature = signature[..signature.len() - 1].to_string();
+    tampered_signature.push(flipped);
+    let tampered_token = format!("{head}.{tampered_signature}");
+
+    let result = decode(&tampered_token, secret);
+    assert!(result.is_err(), "Token with tampered signature should fail to decode");
+}
+
 #[test]
 fn test_jwt_with_expired_token() {
     let expired_claims = json!({