fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all failing tests and type errors in the multi-package HTTP API repo. bun test now reports 22 pass / 0 fail and bunx tsc --noEmit is clean (0 errors) — up from 13 pass / 9 fail and 14 type errors.

Five source-level bug fixes across both api and shared packages. No test files, package.json, or lockfiles were modified, and no dependencies were added.

Fixes

1. Pagination utility (packages/shared/src/utils/pagination.ts) — implemented paginate<T>(), which was a stub throwing not implemented. Uses slice(start, start + size) with total: items.length and totalPages: Math.ceil(total / size); the empty-array case falls out naturally (Math.ceil(0/size) === 0). Clears 7 failing tests.

2. Missing import (packages/api/src/routes/users.ts) — added badRequest to the existing ../lib/errors import (mirroring posts.ts). Fixes a ReferenceError that returned 500 instead of 400 on invalid input, and clears TS2552.

3. Field-name inconsistency (packages/shared/src/types.ts) — renamed User.userName -> username to match both the immutable tests and the db.create call sites. Clears 5x TS2561.

4. Auth middleware case-sensitivity (packages/api/src/middleware/auth.ts) — the public-method allow-list contained lowercase "post", but c.req.method is uppercase (RFC 7231 / WHATWG fetch normalisation), so POST never matched and returned 401 instead of being public. Changed to "POST". Verified no regression: PUT/PATCH/DELETE still require a token.

5. Type config (tsconfig.json) — added "types": ["bun-types"] to resolve bun:test and the process global. bun-types is an already-declared devDependency, so this closes a config gap rather than adding a dependency. Clears 4x TS2307 + 4x TS2580.

Verification

• bun test -> 22 pass / 0 fail
• bunx tsc --noEmit -> exit 0, no errors
• git status confirms only the 5 intended source files changed; no test/dep changes

Assumptions & notes

• username vs userName: since tests are immutable and use username, the User type was the source of the inconsistency and was aligned to username.
• Out of scope (left unchanged, constrained by immutable tests): non-constant-time token comparison, hardcoded "test-token" fallback secret, and the intentionally-public unauthenticated POST. Also noted during review but not required by the tested contract: paginate does not guard negative page or size = 0 (no caller wires user input through it today).