s3: drop an unused Readable import; de-flake the tampered-signature test

The test overwrote the first signature hex char with a fixed '0', a no-op
1 time in 16 when the real signature already starts with 0 — flip the char
instead so the tamper is guaranteed.

Author: melvincarvalho

s3/plugin.js

@@ -64,7 +64,6 @@
 //      no weaker than Bearer, but it is NOT a true secret — documented.
 
 import crypto from 'node:crypto';
-import { Readable } from 'node:stream';
 
 const XML_TYPE = 'application/xml';
 const S3_MAX_KEYS = 1000; // hard cap on a single ListObjectsV2 page

s3/test.js

@@ -261,7 +261,10 @@ describe('s3 plugin', () => {
     it('a tampered signature is refused with SignatureDoesNotMatch (403)', async () => {
       const url = s3('/sigbucket/obj.txt');
       const headers = sign({ method: 'GET', url, host, token });
-      headers.authorization = headers.authorization.replace(/Signature=./, 'Signature=0');
+      // flip (not overwrite) the first hex char — a fixed replacement is a
+      // no-op 1 time in 16, when the real signature already starts with it
+      headers.authorization = headers.authorization.replace(
+        /Signature=(.)/, (_, c) => `Signature=${c === '0' ? '1' : '0'}`);
       const res = await fetch(url, { headers });
       assert.strictEqual(res.status, 403);
       assert.ok((await res.text()).includes('<Code>SignatureDoesNotMatch</Code>'));