test: prune redundant cases and add high-risk coverage across crates (#4208)

Remove or consolidate 57 test cases that cannot catch regressions
(literal-constant asserts, construct-then-assert, derived-serde
round-trips, near-duplicate env/getter matrices) in common, config,
iam, madmin, and object-capacity, keeping all wire-format and
error-path guards. Add 13 tests for previously uncovered high-risk
behavior: filemeta version-sort determinism and merge resilience to
garbage headers, zip extraction path-traversal rejection and exact
limit boundaries, JWT tampered-signature rejection, and the bytes
variant of dual-key (rustfs/minio) metadata fallback and precedence.

Test-only change; no production code touched.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

crates/zip/src/lib.rs

@@ -1532,6 +1532,85 @@ mod tests {
         assert!(matches!(err, ZipError::UnsafeEntryPath(path) if path == "../escape.txt"));
     }
 
+    #[tokio::test]
+    async fn test_extract_zip_rejects_parent_traversal_entry_and_writes_nothing_outside_target() {
+        let temp = tempdir().expect("tempdir should be created");
+        let zip_path = temp.path().join("traversal.zip");
+        let extract_path = temp.path().join("extract");
+
+        build_zip_file_with_entries(&zip_path, &[("safe.txt", b"safe"), ("../escape.txt", b"escape")])
+            .await
+            .expect("zip fixture should be created");
+
+        let err = extract_zip_simple(&zip_path, &extract_path)
+            .await
+            .expect_err("zip entry with parent traversal should be rejected");
+
+        assert!(matches!(err, ZipError::UnsafeEntryPath(path) if path == "../escape.txt"));
+        assert!(
+            fs::metadata(temp.path().join("escape.txt")).await.is_err(),
+            "traversal entry must not be written outside the extraction target"
+        );
+        assert!(
+            fs::metadata(extract_path.join("escape.txt")).await.is_err(),
+            "traversal entry must not be written inside the extraction target either"
+        );
+    }
+
+    #[tokio::test]
+    async fn test_extract_zip_allows_entry_count_exactly_at_limit() {
+        let temp = tempdir().expect("tempdir should be created");
+        let zip_path = temp.path().join("at-limit.zip");
+        let extract_path = temp.path().join("extract");
+
+        build_zip_file_with_entries(&zip_path, &[("one.txt", b"1"), ("two.txt", b"2")])
+            .await
+            .expect("zip fixture should be created");
+
+        let entries = extract_zip_with_limits(
+            &zip_path,
+            &extract_path,
+            ArchiveLimits {
+                max_entries: 2,
+                ..ArchiveLimits::default()
+            },
+        )
+        .await
+        .expect("entry count exactly at the limit should extract successfully");
+
+        assert_eq!(entries.len(), 2);
+    }
+
+    #[tokio::test]
+    async fn test_extract_zip_allows_total_unpacked_size_exactly_at_limit() {
+        let temp = tempdir().expect("tempdir should be created");
+        let zip_path = temp.path().join("total-at-limit.zip");
+        let extract_path = temp.path().join("extract");
+
+        build_zip_file_with_entries(&zip_path, &[("one.txt", b"12345"), ("two.txt", b"67890")])
+            .await
+            .expect("zip fixture should be created");
+
+        let entries = extract_zip_with_limits(
+            &zip_path,
+            &extract_path,
+            ArchiveLimits {
+                max_total_unpacked_size: 10,
+                ..ArchiveLimits::default()
+            },
+        )
+        .await
+        .expect("total unpacked size exactly at the limit should extract successfully");
+
+        assert_eq!(entries.len(), 2);
+        assert_eq!(
+            fs::read(extract_path.join("two.txt"))
+                .await
+                .expect("second entry should be extracted"),
+            b"67890"
+        );
+    }
+
     #[tokio::test]
     async fn test_extract_zip_rejects_too_many_entries() {
         let temp = tempdir().expect("tempdir should be created");