fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all 9 failing tests and all tsc --noEmit errors in the multi-package API repo. End state: 22 pass / 0 fail, tsc exit 0. No test files were modified and no dependencies were added.

Root causes & fixes

• shared/types.ts — User.userName renamed to username. The field name was inconsistent: every consumer (API routes, DB layer, and all tests) used username; only the shared type was wrong.
• shared/utils/pagination.ts — implemented the paginate() stub (previously threw not implemented). Returns the exact PaginatedResponse<T> shape (data, page, pageSize, total, totalPages); raw page is echoed back as the tests require (no clamping).
• api/routes/users.ts — added the missing badRequest import. Its absence caused a ReferenceError on the invalid-body path, returning 500 instead of 400.
• api/middleware/auth.ts — fixed a case-sensitivity bug in the public-methods allow-list: ["GET", "post"] → ["GET", "POST"], so POST /users is correctly treated as public.
• tsconfig.json — added "types": ["bun-types"] so bun:test and the process global type-check. bun-types was already an existing devDependency (transitively pulls in @types/node); no new dependencies were added.

Verification

• bun test → 22 pass / 0 fail
• bunx tsc --noEmit → exit 0
• Independent review pass confirmed the diff is minimal, no test files touched, package.json unchanged, and the userName→username rename has no stragglers.

Assumptions / notes

• README.md retains the line User.userName should be username under "Known issues (intentional — for agent testing)" — this is test-fixture scaffolding, not stale user docs, so it was intentionally left as-is.
• Unauthenticated POST /users is public by design per the middleware policy and is asserted by auth.test.ts; preserved as specified. Flagged here only as a note: in a real service, unauthenticated writes would warrant an access-control review.
• paginate() has no guards for page < 1 / size <= 0. There is no production caller today and the tests don't exercise these, so input validation was left out to honour the "fix only what tests require" constraint — worth adding at the route boundary if it's ever wired to query-string input.