fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Repairs all failing tests and type errors in the Bun + Hono TypeScript multi-package repo. Baseline was 9 failing tests + 14 tsc errors; now 22/22 tests pass and tsc --noEmit is clean (0 errors). No test files were modified and no dependencies were added.

Changes

• packages/shared/src/utils/pagination.ts — implemented the previously-stubbed paginate<T>. Slices (page-1)*size; sets total = items.length and totalPages = Math.ceil(total/pageSize) (yields 0 for empty array as the test requires). Page/size are clamped to >= 1 and floored with finite-number guards so 0/negative/NaN/fractional inputs can't produce a negative slice index or divide-by-zero. Fixes 7 paginate test failures.
• packages/shared/src/types.ts — renamed User.userName → username to match API usage and the tests (README confirmed this direction). Clears 5 TS2561 errors.
• packages/api/src/routes/users.ts — added the missing badRequest import from ../lib/errors, fixing TS2552 and the runtime ReferenceError on POST /users with missing fields.
• packages/api/src/middleware/auth.ts — fixed a case-sensitivity bug in public-route HTTP method matching (["GET","post"] → ["GET","POST"] and compare against method.toUpperCase()). Fixes the POST /users is public test.
• tsconfig.json — added "types": ["bun-types"] (already an installed devDependency) so process and bun:test resolve, and set "lib": ["ES2022"]. Resolves the remaining TS2580/TS2307 errors.

Verification

bun test          -> 22 pass / 0 fail
bunx tsc --noEmit -> 0 errors

Review notes / assumptions

• Reviewed by the review subagent (approved) and independently re-verified. Pagination invariants checked across 16 edge-case inputs.
• lib narrowed to ES2022 (server-only, no DOM): the default DOM lib masked typos of browser globals in this server-only codebase; narrowing makes those error correctly while keeping bun/server globals resolving. If target is bumped later, bump lib in step.
• username rename direction: tests and README use lowercase username; only types.ts used userName. Since test files must not change, source was aligned to username.
• Left untouched (out of scope): stale README "seeded bugs" list; unused requireFields in validate.ts; paginate has no route consumer yet. None affect the gates.