fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all 9 failing tests and all 14 tsc type errors in the api + shared monorepo. Final state: 22 pass / 0 fail, npx tsc --noEmit clean. Changes are scoped to 5 source files (9 insertions, 22 deletions — most deletions are stale BUG:/TODO: markers). No test files modified, no dependencies added.

Fixes

• shared/src/utils/pagination.ts — implemented the paginate() stub. Pages are 1-indexed; page/pageSize/total/totalPages are returned raw (no clamping) to match the test contract, including totalPages: 0 for an empty array and empty data for out-of-range pages.
• api/src/middleware/auth.ts — case-sensitivity bug: public-methods list held "post" but c.req.method is uppercase, so unauthenticated POST wrongly returned 401. Changed to "POST". DELETE still requires a Bearer token (unchanged, still green).
• shared/src/types.ts — renamed User.userName → User.username to match the tests and the api call sites (db.ts, users.ts); the type was the inconsistent side.
• api/src/routes/users.ts — added the missing badRequest import from ../lib/errors (was throwing ReferenceError, failing the 400-on-missing-fields test).
• tsconfig.json — added "types": ["bun-types"] to resolve the bun:test module and process global type errors. bun-types was already in root devDependencies — nothing installed.

Verification

bun test          # 22 pass, 0 fail
npx tsc --noEmit  # exit 0, no output

Assumptions & notes

• Tests are the source of truth. Where a source type disagreed with a test (the userName/username field), the source was corrected, not the test.
• Out of scope (flagged, not changed): paginate() does not validate negative/zero page/size (e.g. page=-1 returns a populated slice; size=0 yields Infinity totalPages). There is no in-repo caller and the task scoped work to the test contract, so this was left as-is. A Math.max(1, Math.floor(...)) clamp would harden it later without breaking the totalPages: 0 empty-array assertion.
• README.md still lists User.userName under "known bugs"; docs-only, left untouched.
• The auth change restores the documented, test-asserted policy that POST is public — it does not broaden exposure. Note this means POST /users/POST /posts accept unauthenticated writes by design of this fixture; would need auth + a collection notice before production use.