fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all failing tests and type errors in the multi-package TypeScript HTTP API repo. After this change: 22/22 tests pass and tsc --noEmit reports zero errors.

Root causes fixed

1. Pagination unimplemented — packages/shared/src/utils/pagination.ts was a stub throwing not implemented. Implemented paginate<T>() with 1-based paging: correct page slice, total, totalPages (ceil(total/size), 0 for empty), partial last page, and empty data for out-of-range pages / empty input.
2. Auth middleware case-sensitivity bug — packages/api/src/middleware/auth.ts listed "post" (lowercase) in the public-methods allow-list, so POST /users (uppercase per RFC 7231) incorrectly required a token. Fixed to "POST". Protected methods still fall through to the token check — no auth bypass introduced.
3. Missing import — packages/api/src/routes/users.ts called badRequest without importing it (ReferenceError). Added the import.
4. Shared type field-name inconsistency — API code used userName while the shared User type and tests use username. Aligned the API package to username.
5. Type-config errors — tsc could not resolve bun:test, the process global, or Bun test globals. Wired bun-types into tsconfig. No source logic affected.

Verification

• bun test → 22 pass, 0 fail
• npx tsc --noEmit → clean (exit 0)
• Independent review pass: APPROVE.

Constraints honored

• No test files modified.
• No new dependencies added (used already-present bun-types).
• Fixed only what the tests required.