fix(browser): preserve S3 object deletion semantics

[cxymds]

Pull Request

Description

Console object deletion could attach X-Rustfs-Force-Delete: true to requests that should have used ordinary S3 deletion semantics. The header is a RustFS recursive-delete extension, so using it for a selected file could require elevated handling and expand the operation beyond the exact object key.

This change keeps the extension for folder-wide Delete All Versions tasks while making every ordinary SDK path S3-compatible:

• ordinary files use DeleteObject, with VersionId only when the user selected a concrete version;
• a file-level Delete All Versions task exhausts ListObjectVersions, keeps only the exact key, and sends explicit version IDs through DeleteObjects in batches of at most 1000;
• ordinary folders retain the existing ListObjectsV2 plus DeleteObjects flow;
• only folder-wide all-version deletion attaches the RustFS force-delete header.

Version and delete-marker enumeration completes before mutation starts, pagination must advance, and partial DeleteObjects failures surface immediately.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Code refactoring
• Performance improvement
• Test improvements
• Security fix

Testing

• Unit tests added/updated
• Manual testing completed

Passed with Node.js 22.22.0 and the pinned pnpm 12.3.4:

pnpm install --frozen-lockfile
pnpm type-check
pnpm lint
pnpm format:check
pnpm test:run
git diff --check

All 583 tests pass. Focused regression coverage verifies exact-key filtering across versions and delete markers, null versions, 1000-item batching, 1001-item pagination, non-advancing pagination rejection, partial batch errors, explicit version deletion, ordinary folder behavior, force-header isolation, and cancellation.

Browser verification used a disposable RustFS backend at commit 4c2ba0896 and the same non-root consoleAdmin user before and after. Single-object deletion changed from HTTP 403 with the force header to HTTP 204 without it. The selected object disappeared and its similarly prefixed sibling remained. Folder deletion also completed at a 390px viewport using standard requests. Independent API probes confirmed that a readonly user is still denied, neighboring prefixes remain intact, and ordinary deletes preserve historical versions in enabled and suspended buckets.

Checklist

• Code follows the project's style guidelines
• Self-review completed
• TypeScript types are properly defined
• All commit messages are in English (Conventional Commits)
• All existing tests pass
• No new dependencies added, or they are justified

Related Issues

Fixes rustfs/rustfs#7649

Screenshots (if applicable)

Desktop captures show the same object deletion with the same IAM user and backend at 1280 x 720.

Before: failed	After: completed

390px viewport: object and folder deletion completed

Additional Notes

The RustFS force-delete extension remains available for a folder-wide all-version operation; SDK users and other S3 clients continue to use standard request shapes. Independent Reviewer and Simplifier passes found no issues in the final behavior or test coverage.

Rollback is a revert of these Console commits. No API, storage, configuration, or data migration is required.