fix(admin): map IAM not found errors to 404

[GatewayJ]

Type of Change

• New Feature
• Bug Fix
• Documentation
• Performance Improvement
• Test/CI
• Refactor
• Other:

Related Issues

Fixes #2681

Summary of Changes

Admin handlers previously wrapped IAM not-found errors as InternalError, which made s3s serialize missing users, groups, policies, and service accounts as HTTP 500 responses.

This change adds a shared IAM-to-S3 error mapper for admin handlers and maps IAM not-found variants to NoSuchKey, which s3s serializes as HTTP 404. Existing non-not-found IAM failures remain InternalError.

The affected group, user, policy, and service account admin paths now return a 404-class response for missing IAM resources so clients can avoid retrying user input errors as server failures.

Checklist

• I have read and followed the CONTRIBUTING.md guidelines
• Passed make pre-commit
• Added/updated necessary tests
• Documentation updated (if needed)
• CI/CD passed (if applicable)

Verification:

• git diff --check passed.
• cargo fmt --all --check passed.
• cargo test -p rustfs --lib admin::handlers passed: 221 passed, 0 failed, 1 ignored.
• make pre-commit was not run per requester instruction.

Impact

• Breaking change (compatibility)
• Requires doc/config/deployment update
• Other impact:

Missing IAM resources on affected admin endpoints now return HTTP 404 instead of HTTP 500.

Additional Notes

Non-not-found IAM errors are still treated as internal server errors.

---

Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md). If this is your first contribution, review the CLA document and sign it by commenting I have read and agree to the CLA. on the PR.

[github-actions]

CLA requirements are satisfied for this pull request.