fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all 9 failing tests and all 14 type errors in the Bun + Hono monorepo. Baseline was 13 pass / 9 fail with 14 tsc errors; now 22 pass / 0 fail and tsc --noEmit is clean.

Changes

• auth middleware (packages/api/src/middleware/auth.ts): the public-methods allow-list contained "post" (lowercase). Hono's c.req.method is uppercase per RFC 7231, so POST fell through to the token check and returned 401. Changed to "POST". This unblocked both auth middleware > POST /users is public and POST /users > returns 400 for missing fields (the latter was hitting 401 before reaching validation).
• users route (packages/api/src/routes/users.ts): added the missing badRequest import from ../lib/errors (already exported and used) — was a ReferenceError at runtime / TS2552 at compile time.
• shared types (packages/shared/src/types.ts): renamed User.userName → username to match the test contract (tests use username exclusively as both create input and serialised field). Propagates cleanly through Omit<User,...> in the db layer.
• pagination (packages/shared/src/utils/pagination.ts): implemented paginate<T> per the contract in packages/shared/test/pagination.test.ts (data slice, total, totalPages, page, pageSize, empty-array and out-of-range-page → empty data). Added guards so non-finite (NaN/Infinity) and <1 page/size — reachable via Number(query) on untrusted input — fall back to safe defaults rather than leaking NaN into the response.
• tsconfig (tsconfig.json): added "types": ["bun-types"] so bun:test and the process global resolve. bun-types was already present in node_modules; no dependency was added.

Verification

• bun test → 22 pass / 0 fail
• npx tsc --noEmit → clean (exit 0)
• No test files were modified; no dependencies added.

Assumptions & notes

• Treated the test files as the source of truth for the username field name and aligned the shared type + api code to them.
• The POST route remaining unauthenticated is the specified contract (asserted by auth.test.ts), so it was left as-is. For a production workload this is worth revisiting (unauthenticated writes).
• Follow-ups left out of scope: README.md still lists these four defects as "known issues"; the non-finite pagination path has no dedicated test (couldn't add one without modifying test files).

🤖 Generated with autonomous agent