fix: resolve failing tests and type errors across api and shared

[stooit]

Summary

• auth middleware: publicMethods had lowercase "post"; Hono gives you methods in uppercase, so POST never matched. Changed to "POST".
• shared types: renamed User.userName to username to match the routes and tests.
• users route: added the missing badRequest import. Without it, invalid payloads crashed with a ReferenceError at runtime.
• pagination: implemented the paginate stub to match the contract in the test file (it computes total and totalPages, and an out-of-range page returns an empty list).
• tsconfig: added "types": ["bun-types"] so bun:test and process resolve. bun-types was already a devDependency.

Verification

bun test && tsc --noEmit: 22 pass, 0 fail, no type errors. An internal review found no blocking issues.

Assumptions / notes

• The tests use username, so I treated that as the correct spelling and changed the shared type to match. No test files were modified and no dependencies were added.
• paginate treats a non-positive or non-numeric page or size as 1. No test checks this.
• auth.test.ts expects POST to need no token, so this PR makes unauthenticated user creation work. Also, if API_TOKEN is unset the API falls back to "test-token". Neither is safe outside a test fixture. I left both alone because they're out of scope.
• The README's "Known issues" section still lists these four bugs. I didn't change it.