fix: resolve failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all 9 failing tests and eliminates all tsc --noEmit type errors. Final state: 22 pass / 0 fail, tsc clean.

Changes

• shared/src/utils/pagination.ts — Implemented paginate() (was a throw "not implemented" stub). Correct page slicing, total/totalPages, out-of-range pages return empty data, empty-array handled.
• api/src/middleware/auth.ts — Fixed HTTP-method case-sensitivity bug so the public-route method (POST) is matched correctly (HTTP methods are uppercase per RFC 7231). POST /users is now correctly treated as public.
• shared/src/types.ts — Renamed User.userName → username to be consistent with the api routes and the (unmodifiable) tests, which use username.
• api/src/routes/users.ts — Added the missing badRequest import; aligned to username.
• tsconfig.json — Added the already-installed bun-types devDependency to compilerOptions.types so bun:test and process globals resolve. No new dependency added; strict unchanged.

Verification

• bun test → 22 pass, 0 fail
• bunx tsc --noEmit → no errors

Assumptions

• The tests are the source of truth, so the shared User field was renamed to username to match them.
• bun-types was already an installed devDependency, so referencing it in tsconfig (rather than installing @types/node) is the minimal, dependency-free way to resolve the process/bun:test type errors.

Constraints honoured

• No test files modified.
• No new dependencies added.