fix: resolve failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all 9 failing tests and eliminates all TypeScript type errors in the monorepo. After this change bun test reports 22 pass / 0 fail and npx tsc --noEmit exits clean.

Root causes & fixes

• Pagination utility (shared) — paginate() was an unimplemented stub throwing not implemented (7 test failures). Implemented the full page-slice contract: total, totalPages (Math.ceil), correct slice offset, out-of-range pages return empty data, empty array yields total: 0, totalPages: 0. Inputs are normalised once at the top (safeSize/safePage) so a negative/Infinity/NaN/non-integer size or page can no longer trigger an over-fetch (e.g. size = -5 previously returned most of the array via slice(0, -5)).
• Shared User type mismatch — source declared userName while the tests and API handlers use username. Renamed User.userName -> username. Because db.create derives its param from Omit<User, "id" | "createdAt">, the single rename propagated structurally with no straggler call-sites.
• Missing import in users route — badRequest was referenced but not imported from ../lib/errors, causing a runtime ReferenceError (Hono returned 500 instead of 400). Added it to the existing import. Fixes "POST /users returns 400 for missing fields".
• Auth middleware case-sensitivity — the public-methods allow-list was ["GET", "post"]; c.req.method is always uppercase, so "post" never matched and POST was incorrectly challenged for a Bearer token. Changed to ["GET", "POST"]. Fixes "POST /users is public". No other methods (PUT/DELETE/PATCH) were broadened.
• tsconfig — added "types": ["bun-types"] so bun:test and the process global resolve. bun-types was already a root devDependency; this only activates it. No new dependencies installed.

Constraints honoured

• No test files modified.
• No new dependencies added.
• Only the 5 source/config files required by the failing tests were touched.

Assumptions & notes

• Tests are treated as the source of truth: the User field was renamed to username (matching tests).
• POST /users and POST /posts are public per auth.test.ts ("POST is intentionally public"). Flagging that unauthenticated record creation without rate limiting is worth a deliberate product decision if this reflects a real API rather than an e2e fixture.
• HEAD/OPTIONS still require auth (pre-existing, out of scope) — a possible follow-up for CORS preflight.

Verification

bun test         -> 22 pass, 0 fail
npx tsc --noEmit -> exit 0