fix: repair failing tests and type errors across api + shared packages

[stooit]

Summary

Fixes all failing tests and type errors in the repo. Before: 13 pass / 9 fail, 14 tsc errors. After: 22 pass / 0 fail, tsc --noEmit clean.

Five bugs fixed across both packages, matching the seeded areas:

• Shared type field mismatch — packages/shared/src/types.ts: renamed User.userName → username to match the contract the tests (and API handlers) assert. Structurally propagates through Omit<User, "id" | "createdAt">, so no stragglers remained.
• Pagination utility stub — packages/shared/src/utils/pagination.ts: implemented paginate per the test contract (data, page, pageSize, total, totalPages), including partial-last-page, out-of-range, and empty-array cases. Signature and PaginatedResponse<T> return type unchanged.
• Auth middleware case-sensitivity — packages/api/src/middleware/auth.ts: public-method allow-list compared against lowercase "post"; the Fetch Request.method is uppercase "POST", so POST /users was wrongly rejected with 401. Fixed to "POST" (fail-closed allow-list).
• Missing import — packages/api/src/routes/users.ts: badRequest was called but never imported, throwing ReferenceError (500 instead of 400). Added to the existing ../lib/errors import.
• Type resolution — tsconfig.json: added "types": ["bun-types"] so bun:test and the process global resolve. bun-types was already in root devDependencies — no new dependency added.

Verification

• bun test -> 22 pass, 0 fail
• bunx tsc --noEmit -> exit 0

Constraint compliance

• No test files modified.
• No new dependencies added.
• Exactly 5 source files changed; scoped to what the tests require.

Reviewer notes (out of scope — not fixed here)

Independent review flagged these as follow-ups, deliberately left out under "fix only what the tests require":

• paginate does not guard page < 1, fractional pages, or non-positive size (no production callers today; validate at the eventual caller when it accepts user query params).
• tsconfig now makes bun-types: "latest" load-bearing for the typecheck — pin to a concrete minor when the dependency freeze lifts.
• Making POST public activates unauthenticated writes to /users and /posts (documented intent, asserted by auth.test.ts), and auth.ts retains a hardcoded test-token fallback — worth a security review before this pattern reaches a real environment.
• README.md "Known issues" still lists the now-fixed bugs.

Assumptions

• The tests are authoritative for field names and behaviour; source was made to conform to them (hence userName -> username, not the reverse).
• The plan doc under docs/plans/ was intentionally left untracked to keep the PR scoped to the fix.