fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all failing tests and eliminates all TypeScript errors across the api and shared packages. Baseline was 13 pass / 9 fail with 16 tsc errors; now 22/22 tests pass and tsc --noEmit is clean. No test files were modified and no dependencies were added.

Fixes

• Shared types (packages/shared/src/types.ts) — the User type used userName while every test asserts username (11 references). Reconciled the type to username to match the test contract.
• Route handler (packages/api/src/routes/users.ts) — added the missing badRequest import from ../lib/errors. This was throwing a ReferenceError instead of returning 400 for missing fields.
• Auth middleware (packages/api/src/middleware/auth.ts) — the public-methods allow-list held "post" (lowercase) but c.req.method is always uppercase per RFC 9110, so public POST was forced through token auth. Hoisted to a PUBLIC_METHODS const and normalised with .toUpperCase().
• Pagination (packages/shared/src/utils/pagination.ts) — implemented the stub: floors page/size at 1, computes totalPages via Math.ceil, slices the page (out-of-range yields []), returns total: 0, totalPages: 0 for empty input.
• tsconfig (tsconfig.json) — added "types": ["bun-types"] (already a root devDependency) to resolve bun:test / process errors in source and tests.

Assumptions

• Field name reconciled toward username, not userName. The task hint suggested tests used userName, but they actually assert username. The tests are the contract, so the source type was fixed to match.

Verification

bun test && bunx tsc --noEmit → 22 pass / 0 fail, tsc exit 0.

Follow-ups (not required by tests, left untouched)

• Auth falls back to a hardcoded "test-token" when API_TOKEN is unset — a weak default credential that should fail closed in any deployed context (ISM-1685/ISM-0421).
• Public POST allows unauthenticated user creation with no rate limiting.