fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all 9 failing tests and all tsc --noEmit type errors in the multi-package Hono API repo. bun test → 22 pass / 0 fail; tsc --noEmit exits clean.

Root causes fixed

• Pagination stub (packages/shared/src/utils/pagination.ts): paginate() threw not implemented. Implemented per the test contract (out-of-range page → empty data, empty array → total/totalPages: 0). Added finite-input clamping so NaN/Infinity page/size coerce to sensible defaults (≥1 integers) rather than propagating.
• Inconsistent shared type (packages/shared/src/types.ts): User.userName renamed to username to match the API routes and tests (tests are the source of truth and use username). Resolved the TS2561 errors.
• Missing import (packages/api/src/routes/users.ts): badRequest was called but never imported → ReferenceError → 500 instead of 400. Added to the existing ../lib/errors import.
• Auth middleware case bug (packages/api/src/middleware/auth.ts): public-methods list had "post" (lowercase); Request.method is always uppercase, so POST /users wrongly required a token (401). Fixed to "POST".
• tsconfig (tsconfig.json): added "types": ["bun-types"] so bun:test and process resolve (both already in node_modules, no new deps).

Constraints respected

• No test files modified.
• No new dependencies added (only wired up already-installed bun-types via tsconfig).
• Minimal scope — a redundant lib tsconfig entry flagged in review was removed to keep to "fix only what tests require".

Assumptions

• Canonical user field is username (per tests), so the shared type was the incorrect side, not the routes.
• POST being unauthenticated is intentional per auth.test.ts and the middleware policy comment. Note for follow-up (out of scope): this permits unauthenticated writes to /users and /posts — worth revisiting for a production posture, but mandated by the tests here.

Verification

• Implementation and both review follow-ups delegated to specialist agents; diff independently reviewed.
• bun test && npx tsc --noEmit verified green after every change.