fix: repair failing tests and type errors across api + shared packages

[stooit]

Summary

Fixes all failing tests and eliminates all tsc --noEmit type errors across the api and shared packages. Bugs spanned both packages plus root config.

Before: 9 failing / 13 passing tests, 14 type errors.
After: ✅ 22/22 tests pass, tsc --noEmit clean (exit 0).

Fixes

• Pagination utility (packages/shared/src/utils/pagination.ts) — implemented the paginate<T>() stub against the contract in its test: 1-based paging, data/total/totalPages/page/pageSize fields, correct partial-last-page, out-of-range (empty data), and empty-array (totalPages: 0) behaviour.
• Auth middleware (packages/api/src/middleware/auth.ts) — the public-route method allow-list compared against lowercase method names while c.req.method is uppercase, so POST /users was failing closed (401) instead of being public. Matched the uppercase method. Verified no new bypass: PUT/DELETE/PATCH still require a token.
• Users route (packages/api/src/routes/users.ts) — badRequest was used but never imported (would throw at runtime); added the import so invalid POSTs return 400 rather than a 500. Also corrected the username field reference (see type alignment below).
• Shared User type (packages/shared/src/types.ts) — renamed userName → username to match the API payloads and DB layer. userName now appears nowhere in the repo; both packages agree.
• tsconfig (tsconfig.json) — added "types": ["bun-types"] so bun:test and process resolve under tsc --noEmit. @types/node reaches the compiler transitively via bun-types' internal /// <reference types="node" />.

Verification

bun test        → 22 pass, 0 fail
bunx tsc --noEmit → exit 0, no errors

Constraints honoured

• No test files modified.
• No new dependencies added (bun-types was already in devDependencies).
• Fixed only what the tests require.

Assumptions & notes

• The username rename went into the shared type (not the tests) because the tests are the fixed point and assert username.
• paginate() was implemented to exactly the asserted contract. It has no input guards for page <= 0 / size <= 0 — intentional scope-limiting (tests don't exercise it and there is no caller in api today). Follow-up recommended: clamp inputs before wiring to user-controlled query params.
• Pre-existing (not introduced here): the auth token check uses a substring .replace("Bearer ", "") rather than a strict prefix strip, so the Bearer scheme is effectively optional. Out of scope — flagging for awareness.