fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all 9 failing tests and all 14 tsc --noEmit type errors. bun test && tsc --noEmit now passes cleanly (22/22 tests, 0 type errors).

The failures spanned both the api and shared packages. Root causes and fixes:

• packages/api/src/routes/users.ts — badRequest was used but never imported, so the missing-fields path threw a ReferenceError and returned 500 instead of 400. Added it to the ../lib/errors import.
• packages/api/src/middleware/auth.ts — the public-method allow-list contained the literal "post" (lowercase), but c.req.method is always uppercase, so public POST /users fell through to token validation and returned 401. Corrected to "POST".
• packages/shared/src/types.ts — the User type declared userName, while every consumer (route, db, all test files) and the JSON wire shape use username. Renamed the field to username; tests are authoritative and could not be changed.
• packages/shared/src/utils/pagination.ts — the paginate utility was an unimplemented throw stub. Implemented per the test contract: 1-indexed page, total = items.length, totalPages = Math.ceil(total / size) (empty array → 0 pages), slice (page-1)*size … page*size, returning all PaginatedResponse fields (size echoed as pageSize).
• tsconfig.json — added "types": ["bun-types"] so bun:test imports and the process global resolve. bun-types (and its transitive @types/node) were already installed; no new dependencies were added.

Testing

• bun test → 22 pass, 0 fail
• npx tsc --noEmit → exit 0, no errors

Assumptions & constraints honoured

• No test files modified.
• No dependencies added — the tsconfig types entry uses the already-installed bun-types.
• Only the changes the tests require were made.

Out-of-scope notes (not changed)

Flagged during implementation but intentionally left as-is because the tests assert the current behaviour:

• auth.ts treats POST /users as a public (unauthenticated) write path — matches the middleware docstring and auth.test.ts. If this middleware is destined for production, the public allow-list should be GET-only.
• auth.ts falls back to a hardcoded "test-token" when API_TOKEN is unset. Convenient for the suite, but a real deploy should fail closed on a missing token.