fix: resolve failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all failing tests and type errors in the multi-package API repo. All 22 tests pass and tsc --noEmit is clean (exit 0). No test files modified, no dependencies added.

Changes

• packages/api/src/routes/users.ts — imported the missing badRequest helper (already defined in lib/errors.ts alongside notFound). POST /users with missing fields now returns 400 instead of throwing a ReferenceError → 500.
• packages/api/src/middleware/auth.ts — fixed a case-sensitivity bug: the public-method allow-list contained "post" (lowercase) while c.req.method is always uppercase, so POST /users never matched and got a 401. Normalised the comparison to be case-insensitive on both sides.
• packages/shared/src/types.ts — renamed User.userName → username to match the field name used by the route handlers and the (unmodifiable) tests. Fixed the TS2561 errors. PaginatedResponse already matched the pagination test contract, so it was left unchanged.
• packages/shared/src/utils/pagination.ts — implemented the paginate() stub: 1-indexed slicing, total/totalPages via Math.ceil, empty data for out-of-range pages, empty-array handling. Added cheap guards for zero/negative size and sub-1 page.
• tsconfig.json — added "types": ["bun-types"] so bun:test and process resolve. bun-types was already an installed devDependency; TypeScript just wasn't auto-including it. No install required.

Verification

bun test                          →  22 pass, 0 fail (4 files)
./node_modules/.bin/tsc --noEmit  →  no output, exit 0

Assumptions / notes

• The tests define the authoritative contract, so where a type and its callers disagreed, the type was corrected to match callers + tests.
• auth.test.ts asserts POST /users is deliberately public; that policy was preserved as required. Flagging: for a real government workload, unauthenticated writes to a user store is an ISM-1546 concern (anonymous record creation, no audit attribution) — production would want auth or at minimum rate limiting plus source-identity audit logging.