fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Makes the full test suite green (22/22 pass) and tsc --noEmit clean. Four distinct bugs spanning both packages, plus one build-config fix.

Changes

• auth middleware (packages/api/src/middleware/auth.ts): the public-methods allow-list used lowercase "post", so POST never matched and the route incorrectly demanded a token. Fixed to "POST" and normalised the incoming method with .toUpperCase() to prevent casing regressions. Fixes auth middleware > POST /users is public.
• shared User type (packages/shared/src/types.ts): renamed User.userName → username to match API usage and the tests.
• users route (packages/api/src/routes/users.ts): added the missing badRequest import — the invalid-body path threw a ReferenceError instead of returning 400. Fixes POST /users > returns 400 for missing fields.
• pagination util (packages/shared/src/utils/pagination.ts): implemented the paginate() stub against the full test contract — 1-indexed pages, totalPages = ceil(total/pageSize) (0 for empty input), out-of-range pages return an empty slice, page/size clamped to ≥1. Fixes all 7 paginate tests.
• tsconfig (tsconfig.json): added "types": ["bun-types"]. bun-types was already an installed devDependency but unreferenced, so process and bun:test didn't resolve.

Verification

• bun test → 22 pass, 0 fail
• tsc --noEmit → exit 0, no errors

Assumptions / notes

• Tests are treated as the source of truth. The userName→username rename was applied to the type (not the route) because the tests use username; aligning the other direction would have broken passing tests.
• Kept the change set minimal and added no dependencies. No test files were modified.
• Non-blocking review observations left for the backlog: POST /users is now genuinely unauthenticated (intended policy, asserted by tests); paginate() doesn't coerce string page/size args; auth's Bearer prefix stripping and token comparison are pre-existing and untouched.