fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all failing tests (was 9 fail / 13 pass, now 22 pass / 0 fail) and eliminates all tsc --noEmit type errors across the api and shared packages. No test files, dependencies, or lockfiles were changed.

Changes

• packages/shared/src/utils/pagination.ts — implemented the paginate<T>() stub (was throwing "not implemented"). 1-indexed pages, slice-based windowing, totalPages via Math.ceil (yields 0 for empty arrays). Added Number.isFinite guards so non-finite page/size fall back to 1/10 instead of leaking NaN into the response.
• packages/api/src/middleware/auth.ts — fixed a case-sensitivity bug in the public-methods list ("post" → "POST"); HTTP methods are uppercase per RFC 7231, so POST /users was never matching and fell through to the token check. Also removed a now-stale bug-description comment.
• packages/api/src/routes/users.ts — added the missing badRequest import from ../lib/errors (was a Cannot find name type error and a runtime ReferenceError on the 400 path). Matches the existing pattern in routes/posts.ts.
• packages/shared/src/types.ts — renamed User.userName → username to match what the (unmodifiable) test files and route handlers use. userName had no other references in code.
• tsconfig.json — added "types": ["bun-types"] to resolve the Cannot find name 'process' / Cannot find module 'bun:test' errors. bun-types (and its transitive @types/node) were already installed and declared as devDependencies — no new dependency added.

Verification

bun test        → 22 pass / 0 fail
npx tsc --noEmit → exit 0

Assumptions & notes

• On the username/userName inconsistency, the tests are authoritative (they can't be modified), so the shared type was moved to username rather than editing tests.
• paginate is exported from @e2e/shared but not yet consumed by any route; GET /users and GET /posts return unpaginated arrays, consistent with the tests as written. Wiring pagination into the list endpoints (with query-param validation returning 400 on non-numeric input) would be the natural follow-up if that was the intent.
• Out of scope (pre-existing, untouched): auth.ts falls back to a hard-coded literal token when API_TOKEN is unset — worth a follow-up hardening issue but unrelated to the failing tests.