fix: resolve all failing tests and type errors

[stooit]

Summary

Makes bun test fully green (22 pass / 0 fail) and bunx tsc --noEmit clean. Fixes bugs spanning both the api (Hono server) and shared (types/utils) packages. No test files were modified and no dependencies were added.

Changes

• shared — pagination utility: implemented paginate<T>() (was a throw "not implemented" stub). Returns the full PaginatedResponse<T> shape (data, page, pageSize, total, totalPages), with out-of-range pages and empty arrays yielding empty data, and a guard against divide-by-zero when size <= 0.
• shared — types: renamed User.userName → username for cross-package consistency (tests and the route handler both use username). Verified no remaining userName references repo-wide.
• api — users route: imported the missing badRequest helper from ../lib/errors, so POST /users with missing fields returns 400 instead of throwing a ReferenceError → 500.
• api — auth middleware: fixed a case-sensitivity bug in the public-method allowlist. The incoming method is now normalised (c.req.method.toUpperCase()) so POST /users correctly matches as a public route.
• tsconfig.json: added types: ["bun-types"] and lib: ["ES2022", "DOM"] so process and the bun:test module resolve (using the already-installed bun-types; no new deps). DOM covers Hono's Request/Response/Headers usage.

Verification

• bun test → 22 pass / 0 fail
• bunx tsc --noEmit → clean (exit 0)

Notes / assumptions

• The auth middleware intentionally treats POST /users as public — packages/api/test/auth.test.ts asserts this. The task was to fix the case-matching bug, not change policy, so this behaviour is preserved. Flagging for awareness: an unauthenticated POST /users permits anonymous account creation, which for a hardened API would conflict with least-privilege principles (ISM-1833/1852). Out of scope here.
• The token check falls back to a hardcoded "test-token" when API_TOKEN is unset and uses a non-constant-time !== comparison. Acceptable as an e2e fixture; would warrant fail-closed + constant-time comparison if promoted to real use. Left unchanged as out of scope.