chore: update h2 and fix clippy lints

[cristi-]

Summary

• update h2 from 0.4.15 to 0.4.16 to resolve RUSTSEC-2026-0258
• box S3 get-object SDK errors to satisfy Rust 1.98's large-error lint
• mark the three intentionally synchronous axum extractors as expected by clippy

Dependency verification

• admitted at the explicitly approved four-day publication age
• verified the checksum against both crates.io metadata and the official registry index
• confirmed dependency, feature, link, and minimum-Rust metadata are unchanged

Validation

• no Cargo commands, Rust tools, crate downloads, builds, or tests were run locally
• GitHub-hosted CI is the only execution environment for this change

[greptile-apps]

Greptile Summary

Updates h2 from 0.4.15 to 0.4.16 and makes lint-oriented Rust changes without altering public behavior.

• Boxes S3 get-object SDK errors to reduce the future-size impact of the error variant.
• Updates downloader tests for the boxed error type.
• Marks three intentionally synchronous Axum extractors with targeted Clippy expectations.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code failure identified.

The dependency update is isolated, S3 errors retain their existing mapping after boxing, and the extractor changes affect lint handling only.

Important Files Changed

Filename	Overview
Cargo.lock	Updates only the h2 package version and checksum; reported advisories for other locked packages predate the PR.
src/object_store/downloader.rs	Boxes get-object SDK errors consistently across both request branches while preserving range parsing and downstream error mapping.
src/service/routes.rs	Adds narrowly scoped Clippy expectations to three extractor implementations without changing their runtime logic.

_{Reviews (1): Last reviewed commit: "chore: update h2 and fix clippy lints" | Re-trigger Greptile}

[shikhar]

handled in #134