fix: repair failing tests and type errors across api and shared

[stooit]

Summary

Fixes all failing tests and eliminates all type errors in the multi-package TypeScript HTTP API repo. After this change: bun test → 22 pass / 0 fail and npx tsc --noEmit → exit 0.

Scope was kept strictly to what the tests require — no new dependencies, no test files modified.

Root causes fixed

File	Bug	Fix
packages/shared/src/utils/pagination.ts	paginate was an unimplemented stub (threw)	Implemented: page slice, total, totalPages via Math.ceil, page/pageSize; empty-array and out-of-range page fall out naturally
packages/shared/src/types.ts	User field name inconsistent (userName) vs what api/tests use (username)	Reconciled to username
packages/api/src/routes/users.ts	Missing badRequest import → ReferenceError → 500 instead of 400 on missing fields	Added badRequest to the existing ../lib/errors import
packages/api/src/middleware/auth.ts	Case-sensitivity bug in the public-methods list ("post") meant public POST /users wrongly required a token	["GET", "post"] → ["GET", "POST"] — the only behavioural change
tsconfig.json	bun:test / process types unresolved (8 tsc errors)	Added "types": ["bun-types"] — uses the already-present devDependency, no new deps

Verification

• bun test → 22 pass, 0 fail
• npx tsc --noEmit → exit 0, no output

Assumptions / notes

• username (lowercase) chosen as the canonical User field because the (unmodifiable) tests read body[0].username.
• No test files were modified.
• Out of scope, flagged for a separate change: auth.ts retains the original process.env.API_TOKEN ?? "test-token" fallback and a non-constant-time !== token comparison. No test covers this and it is pre-existing behaviour, so it was intentionally left untouched here — but it is a genuine security issue (production silently accepts a hardcoded token if API_TOKEN is unset) worth addressing in a scoped follow-up rather than smuggling into a "fix failing tests" diff.