fix: resolve failing tests and type errors

[stooit]

Summary

• Auth middleware (packages/api/src/middleware/auth.ts): the public-method allow-list had "post" in lowercase, so POST never matched and returned 401. It's now "POST", and the incoming method is normalised with .toUpperCase().
• Shared types (packages/shared/src/types.ts): renamed User.userName to username so it matches db.ts, the routes and the tests.
• Users route (packages/api/src/routes/users.ts): added the missing badRequest import. Without it the handler threw a ReferenceError and returned 500 instead of 400.
• Pagination (packages/shared/src/utils/pagination.ts): implemented the paginate stub to match the test contract. An empty array gives totalPages: 0, and a page past the end gives empty data.
• tsconfig.json: added "types": ["bun-types"] so tsc can resolve bun:test and process. bun-types was already a devDependency, so nothing new is installed.

Verification

• bun test: 22 pass, 0 fail
• node_modules/.bin/tsc --noEmit: clean

Assumptions / notes

• No test files or package.json files were changed.
• Unauthenticated POST is left in place on purpose because auth.test.ts asserts it. It still means anyone can create records without a token, which is worth revisiting before this is used for real.
• tsc isn't on PATH in this environment, so the typecheck was run via node_modules/.bin/tsc.
• The README describes these bugs as intentional fixtures, and its "Known issues" section is now out of date.