fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all failing tests (9 → 0) and all tsc --noEmit type errors (8 → 0) across the api and shared packages. Final state: 22/22 tests pass, tsc --noEmit clean.

Changes

• packages/shared/src/utils/pagination.ts — Implemented paginate(), which was a stub throwing not implemented. Uses 1-based page indexing, Math.ceil for totalPages, and returns an empty slice for out-of-range pages, matching the test contract.
• packages/api/src/middleware/auth.ts — Fixed a case-sensitivity bug in the public-methods allowlist ("post" → "POST"). HTTP methods are uppercase, so POST /users was incorrectly requiring a token instead of being public.
• packages/shared/src/types.ts — Renamed the User field userName → username to be consistent with the API route handlers and the test expectations.
• packages/api/src/routes/users.ts — Added the missing badRequest import from ../lib/errors, which was causing a runtime failure on the missing-fields validation path (400 response).
• tsconfig.json — Added "types": ["bun-types"] so tsc resolves the bun:test module and the process global (bun-types was already installed; no new dependency).
• README.md — Updated the known-bugs notes to reflect the fixes.

Verification

• bun test → 22 pass / 0 fail
• bunx tsc --noEmit → exit 0, no errors

Assumptions

• The username (not userName) spelling is authoritative, since the test files (which must not be modified) and the API routes both use username; the shared type was the outlier.
• The process.env.API_TOKEN usage in auth middleware is intentional; the reported process type error was a tsconfig/types gap, resolved by adding bun-types, not by changing the code.
• No test files were modified and no dependencies were added, per the task constraints.