fix: resolve failing tests and type errors

[stooit]

Summary

• auth middleware: public-method allow-list had "post" instead of "POST", so unauthenticated POST was rejected; also normalises incoming method case.
• shared types: renamed User.userName → username to match API routes and tests.
• users route: added missing badRequest import (was a runtime ReferenceError on invalid body).
• pagination: implemented paginate stub (slice, total, totalPages = ceil(total/size), empty for out-of-range pages; page/size clamped to ≥1).
• tsconfig: added "types": ["bun-types"] (already a dev dep) so bun:test and process resolve.

Result: bun test 22/22 pass, tsc --noEmit clean.

Assumptions

• Tests are authoritative (e.g. username field naming, POST being public per auth tests).
• No test files modified; no dependencies added.