fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all failing tests (9 → 0) and type errors (14 → 0) across the api and shared packages. bun test (22 pass) and npx tsc --noEmit (exit 0) are both green. No test files were modified and no dependencies were added.

Changes

• packages/shared/src/utils/pagination.ts — implemented the stubbed paginate(). Slices from (page-1)*size, so out-of-range pages yield []; totalPages = Math.ceil(total/size) (0 for empty). Guards start < 0 (a negative slice start would otherwise return items from the end of the array) and size <= 0 (division-by-zero).
• packages/shared/src/types.ts — renamed User.userName → username. Both packages' tests construct users with username, so the type was the inconsistency.
• packages/api/src/middleware/auth.ts — public-methods allow-list had "post" (lowercase); c.req.method is always uppercase per RFC 7231, so POST never matched and fell through to token validation (401). Changed to "POST".
• packages/api/src/routes/users.ts — added the missing badRequest import; it was referenced in the missing-fields branch, throwing a ReferenceError (500 instead of the expected 400).
• tsconfig.json — added "types": ["bun-types"] so bun:test and the process global resolve. bun-types was already a devDependency; nothing new installed.

Verification

```
bun test → 22 pass, 0 fail
npx tsc --noEmit → exit 0
```

Assumptions & scope notes

• Tests are canonical. Where source disagreed with a test (the userName/username field), the source was fixed, not the test.
• Scope kept minimal per the task ("fix only what the tests require"). Reviewer flagged optional hardening — non-integer page/size normalisation in paginate — which no test exercises and no production caller passes; left out to avoid scope creep.
• Public POST /users is intentional, test-enforced in auth.test.ts with an explicit comment. Noted only for awareness: unauthenticated writes would be an access-control concern in a real service.

🤖 Generated autonomously.