fix: make all tests pass and clear type errors

[stooit]

Summary

Fixes all 9 failing tests and all 14 tsc --noEmit errors across the api and shared packages. Root cause was four independent seeded bugs plus one tsconfig gap.

Changes

• packages/shared/src/utils/pagination.ts — implemented paginate() (was a throwing stub). total = items.length, totalPages = Math.ceil(total / size), start = (page - 1) * size, data = items.slice(start, start + size). slice naturally yields [] for out-of-range pages and the short final page; Math.ceil(0/size) === 0 gives totalPages: 0 for the empty-array case.
• packages/api/src/middleware/auth.ts — case-sensitivity bug: public-methods allow-list had "post" (lowercase); HTTP methods are uppercase (RFC 7231), so POST /users was wrongly requiring a token. Changed to "POST".
• packages/api/src/routes/users.ts — added missing badRequest import from ../lib/errors (was a ReferenceError at runtime on invalid POST bodies).
• packages/shared/src/types.ts — User.userName → username to match API usage and test expectations (field-name inconsistency between packages). The rename was the correct direction because three of the four type-error sites were in test files, which must not be modified.
• tsconfig.json — added "types": ["bun-types"] to resolve bun:test (TS2307) and process (TS2580) errors in one key. No dependency added — bun-types (and transitive @types/node) were already on disk.

Verification

• bun test -> 22 pass, 0 fail (was 13 pass / 9 fail)
• tsc --noEmit -> 0 errors, exit 0 (was 14 errors)

Constraints honoured

• No test files modified. No dependencies added. No package.json change. Only the five source/config files above were touched.

Assumptions

• The single source of truth for the user field is username (lowercase), since test files reference it and cannot be edited.
• POST /users being public is pre-existing intended behaviour of this test corpus; the auth fix restores documented behaviour rather than widening access.