fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all failing tests (was 13 pass / 9 fail → now 22 pass / 0 fail) and eliminates all tsc --noEmit type errors (now 0 errors) across the api and shared packages.

Changes (5 files — no test files modified, no new dependencies)

• packages/shared/src/utils/pagination.ts — Implemented paginate<T> (was a throwing stub). Returns { data, page, pageSize, total, totalPages }; out-of-range pages yield empty data, empty arrays yield total: 0, totalPages: 0. Added minimal page/size normalisation to prevent negative slice offsets silently returning tail items.
• packages/api/src/routes/users.ts — Added missing badRequest import from ../lib/errors (the unresolved reference was throwing a ReferenceError, turning intended 400s into 500s).
• packages/shared/src/types.ts — Renamed User.userName → username for consistency with the route code and tests. Audited both packages; this was the only mismatched field.
• packages/api/src/middleware/auth.ts — Fixed public-method allow-list casing ("post" → "POST", hoisted to a PUBLIC_METHODS const, compared against method.toUpperCase()), so public POST routes no longer return 401.
• tsconfig.json — Added "types": ["bun-types"], which transitively references @types/node. Both packages were already installed in the Bun store but not auto-included; this one line resolves all bun:test and process type errors (including those in test files, without editing them).

Verification

• bun test → 22 pass / 0 fail
• npx tsc --noEmit → 0 errors

Assumptions / notes

• Tests were treated as the source of truth: username (not userName) is the canonical field name.
• Security note (out of scope, flagged for follow-up): the auth middleware makes POST public by HTTP method rather than by route, meaning unauthenticated user creation is allowed. The test "POST /users is public (no token required)" asserts this as intended behaviour, so it was implemented as specified — but a method-keyed allow-list is a weak authorisation model and warrants a dedicated security review before any real deployment.