fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Makes bun test && bunx tsc --noEmit fully pass — 22/22 tests green, zero type errors. Fixes span both the api and shared packages. No test files were modified and no dependencies were added.

Fixes

• Pagination utility (packages/shared/src/utils/pagination.ts): implemented the paginate() stub per the test contract — page slicing, total/totalPages, page/pageSize, out-of-range → empty data, empty-array handling, and a divide-by-zero guard for size = 0.
• Auth middleware (packages/api/src/middleware/auth.ts): fixed a case-sensitivity bug — the public-route allow-list now compares against uppercase HTTP methods (Hono exposes c.req.method as uppercase), so POST /users is correctly public.
• Users route (packages/api/src/routes/users.ts): added the missing badRequest import that caused a runtime/type failure, and reconciled the request-body field to username.
• Shared types (packages/shared/src/types.ts): renamed User.userName → username to match what the route, db layer, and tests all expect (tests treated as source of truth).
• tsconfig (tsconfig.json): added typeRoots/types so TypeScript resolves the already-installed @types/node and bun-types. Pure compiler config — no new dependency.

Assumptions

• The tests are the source of truth for the correct field name (username) and API contract; non-test code was changed to match.
• @types/node and bun-types were already present in node_modules; the tsconfig change only points the compiler at them.

Verification

• bun test → 22 pass, 0 fail
• bunx tsc --noEmit → exit 0, no errors
• Independent review pass: clean bill of health on all five changed files.