fix: resolve failing tests and type errors - #201

Summary

• shared/pagination: implemented paginate stub (slice by page/size, totalPages = ceil(total/size), empty data for out-of-range pages; defensive clamping of page/size).
• shared/types: renamed User.userName → username to match routes and tests.
• api/routes/users: added missing badRequest import (was a runtime ReferenceError on invalid POST).
• api/middleware/auth: public-method allow-list had lowercase "post"; now ["GET","POST"] with method normalised via toUpperCase().
• tsconfig: added "types": ["bun-types"] (already a declared devDependency) to resolve bun:test/process types.

Result: bun test 22/22 pass, tsc --noEmit clean.

Assumptions / notes

• Tests are the source of truth; no test files modified, no dependencies added.
• The auth fix makes POST unauthenticated, as asserted by auth.test.ts ("POST is intentionally public"). Reviewers should confirm this policy is actually intended — unauthenticated writes are usually undesirable.
• Out of scope but flagged: token compared with non-constant-time !==, and a hardcoded "test-token" fallback when API_TOKEN is unset.