fix: make all tests pass and eliminate type errors

[stooit]

Summary

Fixes all 9 failing tests and all 15 tsc --noEmit type errors across the api and shared packages. Now: 22/22 tests pass, tsc --noEmit exits clean.

Fixes

File	Change	Fixes
packages/shared/src/utils/pagination.ts	Implemented the stubbed paginate() (slice + Math.ceil total pages)	7 pagination tests
packages/api/src/routes/users.ts	Added missing badRequest to the errors import (was a ReferenceError → 500 instead of 400)	POST /users returns 400 for missing fields
packages/api/src/middleware/auth.ts	Fixed lowercase "post" in the public-methods list → "POST" (HTTP methods are uppercase per RFC 7231)	POST /users is public (no token required)
packages/shared/src/types.ts	Renamed User.userName → username to match the API route and test usage	5 TS2561 type errors
tsconfig.json	Added "types": ["bun-types"] (already an installed devDependency) so bun:test and process resolve	8 bun:test / process type errors

Verification

• bun test → 22 pass, 0 fail
• bunx tsc --noEmit → exit 0, no output

Constraints honoured

• No test files modified — tests treated as the source of truth; the userName→username direction was chosen to match the tests.
• No new dependencies added — bun-types was already present.
• Scope limited to what the tests require (diff: 5 files, +10 / -22).

Notes for reviewers (non-blocking, out of scope)

• paginate() has no guards for negative/zero page/size; no caller or test exercises those branches, so it was kept test-driven. Worth clamping if it's ever wired to untrusted query input.
• Pre-existing (untouched): auth.ts falls back to a hardcoded "test-token" when API_TOKEN is unset (CWE-798). Fine for this test corpus; would need a fail-closed guard before production.
• README.md still lists these as "intentional bugs" — left as-is.

🤖 Generated autonomously.