fix: repair failing tests and type errors across api & shared packages

[stooit]

Summary

Fixes all failing tests and type errors in the monorepo. Result: bun test → 22 pass / 0 fail (was 13/9) and npx tsc --noEmit → 0 errors (was 14).

Changes

• packages/shared/src/utils/pagination.ts — implemented the paginate stub: slices at (page-1)*size, returns data, page, pageSize, total, totalPages. Handles empty arrays and out-of-range pages (empty data); clamps page/size to a floored minimum of 1 to avoid divide-by-zero. Fixes 7 pagination tests.
• packages/shared/src/types.ts — renamed User.userName → username. The type declaration was the odd one out; all three test files, both route handlers, and the POST body contract use username. Clears the TS2561 field-mismatch errors (incl. ones inside test files that can't be edited).
• packages/api/src/middleware/auth.ts — fixed a case-sensitivity bug: publicMethods contained "post" so POST never matched and was forced down the token path (401). Now ["GET","POST"] compared via .toUpperCase(). Fixes the "POST /users is public" test; the DELETE→401 test still passes, so the auth boundary is unchanged.
• packages/api/src/routes/users.ts — added the missing badRequest import from ../lib/errors (was a runtime ReferenceError / TS2552). Fixes the "400 for missing fields" test.
• tsconfig.json — added "types": ["bun-types"]. Config-only fix; bun-types was already present in node_modules/devDependencies but not being loaded. Resolves the bun:test (TS2307) and process global (TS2580) errors. No new dependencies added.

Assumptions

• Tests are the source of truth for the intended field name — production code was aligned to username, tests were left untouched.
• The bun:test/process errors were treated as a tsconfig types configuration gap rather than a missing dependency (verified bun-types already installed).
• Constraints honoured: no test files modified, no new dependencies.

Notes for reviewer (pre-existing, out of scope — left unchanged)

• POST /users being unauthenticated is asserted by auth.test.ts; for a government API this permits unauthenticated writes (tension with ISM-1546 / audit attributability) — flagged for a product decision, not silently changed.
• middleware/validate.ts requireFields is defined but unused; both routes hand-roll validation.

Verification

• bun test → 22 pass / 0 fail
• npx tsc --noEmit → exit 0, no errors