fix: resolve failing tests and type errors

[stooit]

Summary

• auth middleware: HTTP method comparison was case-sensitive ("post" vs "POST"); now normalised with toUpperCase() against a fail-closed PUBLIC_METHODS allow-list.
• shared types: renamed User.userName → username to match API routes and tests.
• pagination: implemented the paginate stub (1-indexed pages, Math.ceil totalPages, empty data for out-of-range pages, page/size normalised against NaN/negative input).
• users route: added missing badRequest import (was a runtime ReferenceError on invalid POST).
• tsconfig: added "types": ["bun-types"] — bun-types was already installed, no new deps.

Result: bun test 22/22 pass, tsc --noEmit clean (previously 9 failing tests, 14 type errors).

Assumptions

• Tests are the source of truth (username, not userName); no test files modified.
• POST remaining unauthenticated is intentional per auth.test.ts and was preserved. Worth reviewing separately for real deployments.
• Unused requireFields in middleware/validate.ts left untouched (out of scope).