fix: resolve failing tests and type errors

[stooit]

Summary

• Auth middleware: publicMethods contained "post" (lowercase) so POST never matched; fixed to "POST" and normalised comparison.
• Shared types: renamed User.userName → username to match api usage and tests.
• Users route: added missing badRequest import (runtime ReferenceError on 400 path).
• Pagination: implemented paginate stub (1-indexed pages, empty/out-of-range handling).
• tsconfig: wired existing bun-types devDependency via "types" so bun:test and process resolve.

bun test → 22 pass / 0 fail; tsc --noEmit → 0 errors.

Assumptions

• Tests are the spec; no test files modified, no new dependencies added.
• paginate clamps page/size to ≥1 (untested edge case) to avoid negative slices / divide-by-zero.

Note

Tests intentionally assert POST is public (unauthenticated writes allowed). Preserved as specified, but worth revisiting from a security standpoint (e.g. ISM-1546).