fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all failing tests and type errors in the monorepo. bun test now passes 22/22 and bunx tsc --noEmit reports 0 errors. No test files were modified and no dependencies were added.

Root causes and fixes

• Pagination stub (packages/shared/src/utils/pagination.ts) — was throwing not implemented. Implemented 1-indexed slicing (page-1)*size with totalPages = Math.ceil(total/size). Out-of-range page and empty-array edge cases fall out naturally.
• Field-name inconsistency (packages/shared/src/types.ts) — User.userName renamed to username to match the test contract (tests use lowercase username). Consumers (routes/users.ts, lib/db.ts) use the field structurally via Omit<User,...> + spread, so no further edits were needed.
• Missing import (packages/api/src/routes/users.ts) — badRequest was used but not imported, causing a runtime ReferenceError on the 400 path. Added to the existing ../lib/errors import.
• Auth case-sensitivity bug (packages/api/src/middleware/auth.ts) — public-methods list had "post" (lowercase); c.req.method is uppercase per RFC 7231, so POST was wrongly challenged for a token. Changed to "POST".
• TS globals (tsconfig.json) — added "types": ["bun-types"]. bun-types was already an installed devDependency but Bun links it at node_modules/bun-types (not @types/bun), so TS auto-discovery missed it. Naming it explicitly resolves the process and bun:test errors (and transitively pulls node types). No new dependency added.

Verification

• bun test → 22 pass / 0 fail
• bunx tsc --noEmit → exit 0
• Independent review pass: APPROVE, no blockers.

Assumptions / notes

• The brief suggested tests expected userName; the actual test contract uses username (lowercase). Since test files must not be modified, the shared type was aligned to the tests.
• Per the "fix only what the tests require" constraint, the following observations were noted by review but left unchanged: paginate() has no negative-page/size<=0 input validation (no call site in api today; the test only exercises positive out-of-range), and POST /users remains intentionally public per auth.test.ts (documented in the fixture as intended — a design question for the corpus owner, not fixable without editing tests).

Generated with QuantCode Agent.