4.47

## What's Changed
* release: wait for Go proxy propagation by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11219
* [Mount] Add ChunkGroup seeking tests and fix boundary handling by @ssshr-66 in https://github.com/seaweedfs/seaweedfs/pull/11223
* fix(mount): bound reader cache memory across open files by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11220
* iam: preserve native Admin when IAM policies are attached (#11226) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11232
* fix(s3api): evaluate aws:SourceIp from the direct TCP peer, not forwarded headers by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11231
* admin: reject IAM policy deletion while still attached to a user/group by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11230
* filer/postgres: create filemeta table on startup via createTable config by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11229
* helm: pass -ip to admin so StatefulSet becomes Ready on 4.46 by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11236
* admin: allow insecurely binding to any IP if -allowInsecureNoAuth is set by @AlessandroZanatta in https://github.com/seaweedfs/seaweedfs/pull/11228
* filer: widen metadata-subscription readahead buffers by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11237
* volume server: release the store lock before scrubbing EC volumes by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11235
* helm: supply admin auth in CI renders that enable admin by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11239
* fix(volume): handle faulty storage media (Go + Rust) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11233
* fix: rebase on latest master before pushing star history chart by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11240
* [Volume] Validate record counts after volume copy by @ssshr-66 in https://github.com/seaweedfs/seaweedfs/pull/11238
* fix(filer): use path.Split instead of filepath.Split for filer paths by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11246
* rust volume: move the crate to edition 2024 by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11244
* iceberg: fix OAuth token expiry handling (401 + token-exchange + configurable TTL) by @lucndm in https://github.com/seaweedfs/seaweedfs/pull/11242
* Mount req with collection by @shaofeng66 in https://github.com/seaweedfs/seaweedfs/pull/11249
* rust: prevent phantom volumes + validate collection hint in mount_volume_by_id by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11254
* s3: bucket-policy Allow must not override an identity explicit Deny by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11256
* filer: end local-only metadata subscriptions when remote peers appear by @Tyagiquamar in https://github.com/seaweedfs/seaweedfs/pull/11251
* fix(volume): Harden Volume Copy Validation and Failure Handling by @ssshr-66 in https://github.com/seaweedfs/seaweedfs/pull/11252
* rust volume: stop glibc retaining freed EC buffers as unreturnable heap by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11255
* fix(s3api/sts): respect MaxSessionLength config in DurationSeconds validation by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11267
* rust volume: honour is_last in the tail sender instead of rescanning the whole volume by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11273
* build(deps): bump github.com/rclone/rclone from 1.75.0 to 1.75.1 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11274
* fix(s3api/iam): avoid transient AccessDenied from full reloads on single IAM file changes by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11271
* fix: write the new key when a remote-synced file is renamed by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11270
* fix(s3api/audit): surface OIDC identity claim in audit log for STS sessions by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11269
* mount: rebuild expired directory cache on entry lookup by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11268
* fix(vacuum): stop comparing compact size against the live needle map by @Koalk in https://github.com/seaweedfs/seaweedfs/pull/11263
* s3 sink: report the source read error the SDK hides by @AdzerKI in https://github.com/seaweedfs/seaweedfs/pull/11277
* s3: fail closed on unsupported bucket-policy condition operators by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11283
* feat(s3api): add bucket quota S3 extension via ?seaweedfs-quota by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11279
* s3: close list-type / ownership-controls routing mismatch by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11280
* s3: reject virtual-host bucket retargeting via X-Forwarded-Host by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11281
* fix(master): stop goraft server on shutdown and bump raft to v1.2.1 by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11284
* test(fuse_failover): dump chunk list and hex on append corruption by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11285
* [Volume] Scrub every disk's EC shards for a volume id, not just the first by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11258
* Fix mount eio on manifest resolve failure by @giftz in https://github.com/seaweedfs/seaweedfs/pull/11287
* [Mount] Cache Chunk Manifest Resolution for Repeated File Opens by @ssshr-66 in https://github.com/seaweedfs/seaweedfs/pull/11266
* fix(vacuum): batch fsync in makeupDiff to prevent test timeout by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11289
* master: name the unlabeled disk layout plainly in assign errors by @lucndm in https://github.com/seaweedfs/seaweedfs/pull/11290
* s3: gate internal LifecycleDelete gRPC behind admin Bearer auth by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11291
* iceberg/s3tables: confine stored metadataLocation to the authorized table bucket by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11292
* test/ec: fix EC interruption matrix slot exhaustion by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11295
* filer: accept gcs credentials file paths in the guarded remote client builder by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11296
* filer: apply SSRF guard to the lazy-remote fetch/list/delete paths by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11294

## New Contributors
* @AlessandroZanatta made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/11228
* @lucndm made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/11242
* @Tyagiquamar made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/11251
* @AdzerKI made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/11277

**Full Changelog**: https://github.com/seaweedfs/seaweedfs/compare/4.46...4.47