fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all failing bun test cases and eliminates all tsc --noEmit type errors across the api and shared packages. No test files were modified and no dependencies were added.

Final state: 22 pass / 0 fail, tsc --noEmit 0 errors.

Changes

• shared/src/utils/pagination.ts — Implemented the paginate() stub. Handles 1-indexed pages, partial last page, out-of-range pages (returns empty data), empty arrays, and a size=0 guard against Infinity in totalPages.
• api/src/middleware/auth.ts — Fixed a case-sensitivity bug: the public-methods allow-list contained lowercase "post", but Hono delivers uppercased HTTP methods, so POST was silently requiring auth. Corrected to "POST". PUT/DELETE/PATCH remain protected.
• api/src/routes/users.ts — Added the missing badRequest import and corrected the username field name to match the shared User type.
• shared/src/types.ts — Aligned the User field name (userName → username) so shared types and all API consumers/tests agree.
• tsconfig.json — Added "types": ["bun-types"] (already a devDependency) to resolve bun:test / process type errors under tsc without touching test files.

Assumptions

• The username (lowercase) spelling is canonical, since the tests and all API route consumers use it; the shared type was the outlier.
• The intended public-methods policy is GET + POST (per the middleware's own documented list).
• bun-types was already present, so referencing it in tsconfig adds no new dependency.

Verification

• bun test → 22 pass, 0 fail
• npx tsc --noEmit → exit 0, no errors
• Independent review pass: APPROVE, no blockers.