fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all failing tests and TypeScript errors in the multi-package API repo. Final state: 22 tests pass / 0 fail, npx tsc --noEmit exits clean.

Changes

• Pagination (shared/src/utils/pagination.ts) — implemented the paginate() stub. Correct page-slice (start = (page-1)*size), totalPages = Math.ceil(total/size), and handling for out-of-range and partial-last-page cases.
• Auth middleware (api/src/middleware/auth.ts) — fixed a case-sensitivity bug in the public-method allow-list (post → POST); HTTP methods arrive upper-cased, so POST /users was wrongly treated as protected.
• Shared types (shared/src/types.ts) — renamed User.userName → username to match what the tests (source of truth) and route handlers expect, restoring cross-package consistency.
• Users route (api/src/routes/users.ts) — added the missing badRequest import causing a runtime/type failure.
• tsconfig.json — added already-installed Bun types to types so Bun globals (bun:test, process) type-check without new dependencies.

Verification

• bun test → 22 pass, 0 fail
• npx tsc --noEmit → exit 0

Assumptions

• The test files are the source of truth for field naming (username), so the shared type was aligned to them rather than the reverse.
• The tsconfig types addition uses only type packages already present in node_modules — no new dependencies were added.
• No test files were modified.

Notes (non-blocking, out of scope)

Review flagged that paginate() does not special-case size = 0 and the auth check could add a defensive .toUpperCase(). Neither is exercised by the test contract, so per the "fix only what tests require" constraint they were left unchanged.