fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Repairs all failing tests and type errors in the monorepo. Baseline was 13 pass / 9 fail with 14 tsc errors; now 22 pass / 0 fail and tsc --noEmit exits 0.

No test files were modified and no dependencies were added, per task constraints.

Fixes

• Pagination (packages/shared/src/utils/pagination.ts): implemented the paginate() stub — page slicing, total, totalPages (Math.ceil, yields 0 for empty), page/pageSize echo, out-of-range page returns empty data.
• Shared types (packages/shared/src/types.ts): renamed User.userName → username to match the field name the tests and route handlers expect. Fixes the cross-package inconsistency (TS2561).
• Users route (packages/api/src/routes/users.ts): added the missing badRequest import from ../lib/errors. This was both the TS2552 type error and the cause of the "returns 400 for missing fields" failure (was throwing a ReferenceError at runtime).
• Auth middleware (packages/api/src/middleware/auth.ts): fixed the case-sensitivity bug — the public-methods list had "post" (lowercase) which never matched Hono's uppercase c.req.method, so POST fell through to the token check and returned 401. Corrected to "POST" and normalised the comparison; hoisted to a module-level const.
• tsconfig (tsconfig.json): added "types": ["bun-types"]. bun-types is an already-declared, already-installed devDependency but Bun installs it outside node_modules/@types, so TypeScript's automatic inclusion missed it — causing Cannot find module 'bun:test' and Cannot find name 'process'. No dependency added.

Verification

bun test  → 22 pass, 0 fail
npx tsc --noEmit → exit 0

Assumptions & notes

• The tests are the source of truth for the username field name; source was made consistent with them.
• auth.test.ts asserts POST is public, so unauthenticated writes are the intended behaviour for this test corpus. A review flagged that an anonymous write path (and the hardcoded default token in auth.ts) would not pass an ISM assessment in production — out of scope for "fix only what the tests require", worth a follow-up.
• Review also noted latent pagination edge cases on NaN/Infinity inputs and unpinned type-dependency versions (no lockfile). Neither is reachable by current call sites nor a regression; left out of scope.

🤖 Generated with autonomous agent