fix: repair failing tests and type errors across api and shared

[stooit]

Summary

Fixes all failing tests and type errors in the repo. Baseline was 9 failing tests + 14 type errors; now 22/22 tests pass and bunx tsc --noEmit is clean (exit 0).

Bugs spanned both packages/api and packages/shared, matching the areas called out in the task.

Changes

File	Fix
packages/shared/src/utils/pagination.ts	Implemented the paginate stub (was throw "not implemented"). Returns { data, page, pageSize, total, totalPages }; out-of-range pages yield an empty slice, empty array yields totalPages: 0. Added Number.isFinite guards so non-finite inputs (e.g. Number(query("page")) → NaN) fall back to 1 rather than serialising to null.
packages/shared/src/types.ts	Renamed User.userName → username to match the field name used everywhere in the API routes and tests.
packages/api/src/routes/users.ts	Added the missing badRequest import from ../lib/errors. Previously threw a ReferenceError → 500 instead of the intended 400 for missing fields.
packages/api/src/middleware/auth.ts	Fixed a case-sensitivity bug: the public-methods allow-list held lowercase "post", so "POST" never matched and public writes were rejected with 401. Normalised the incoming method with .toUpperCase() against a canonical uppercase list. Fails closed — unrecognised methods still require a token.
tsconfig.json	Added "types": ["bun-types"] to resolve Cannot find module 'bun:test' and Cannot find name 'process'. bun-types was already a devDependency; @types/node globals come in transitively. No new dependency.

Verification

```
bun test → 22 pass, 0 fail
bunx tsc --noEmit → exit 0, zero errors
```

Constraints honoured

• No test files modified (git diff --stat touches only 5 source/config files).
• No new dependencies added.

Assumptions

• username vs userName: the test files (unmodifiable, treated as source of truth) use `username`, so the shared `User` type was aligned to `username` rather than the reverse.
• POST is intentionally public: `auth.test.ts` explicitly asserts unauthenticated POST returns 201, so the middleware was fixed to match.

Follow-ups (out of scope, not addressed)

Surfaced during review — no live caller today, so non-blocking:

• Public unauthenticated writes (POST) + a hardcoded `"test-token"` fallback and timing-observable `!==` token compare in `auth.ts` would need attention before production (ISM-1546 / APP 11 if `User.email` is real PII).
• No upper bound on a finite `pageSize` — worth capping if `paginate` is ever exposed to untrusted query params.