fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Repairs all failing tests and TypeScript errors so bun test && tsc --noEmit is fully green (22 tests pass, clean tsc). Fixes span both the api and shared packages.

Root causes & fixes

• Auth middleware (packages/api/src/middleware/auth.ts) — case-sensitivity bug in the HTTP-method comparison meant POST /users was not recognised as a public route (and process global was unresolved). Fixed the method check and type resolution.
• Shared types (packages/shared/src/types.ts) — the User field was named inconsistently (userName) vs. what callers and tests expect (username). Renamed to username for cross-package consistency; tests are the source of truth.
• Users route (packages/api/src/routes/users.ts) — missing badRequest import caused a runtime failure on the "returns 400 for missing fields" path. Added the import.
• Pagination utility (packages/shared/src/utils/pagination.ts) — was a stub throwing "not implemented". Implemented paginate() to satisfy the full contract: page slice + total, totalPages, page, pageSize, handling out-of-range pages, empty arrays, and partial last pages.
• tsconfig — wired up bun-types (already present in the repo) so process and bun:test globals resolve. No broad check-disabling.

Verification

• bun test → 22 pass / 0 fail
• tsc --noEmit → exit 0 (clean)
• Reviewed via the review subagent: verdict COMMENT, no blocking issues; fixes are real and minimally scoped.

Constraints honoured

• No test files modified.
• No new dependencies added (used bun-types already in the repo).
• Changes limited to what the tests require.

Assumptions

• The lowercase username field name is canonical, chosen because the (unmodifiable) tests consistently use it.
• bun-types was already available in the repo, so tsconfig wiring is configuration only — nothing installed.