fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all 9 failing tests and all 14 tsc --noEmit errors in the multi-package repo. Final state: 22 pass / 0 fail, zero type errors. No test files modified, no dependencies added.

Changes (5 source/config files)

File	Change
tsconfig.json	Added "types": ["bun-types"] — resolves bun:test (TS2307) and process (TS2580) errors. bun-types was already a root devDependency; no new deps.
packages/shared/src/types.ts	Renamed User field userName → username to match what the (unmodifiable) test files send and assert.
packages/api/src/routes/users.ts	Added missing badRequest import from ../lib/errors — the ReferenceError was surfacing as a 500 where a 400 was expected.
packages/api/src/middleware/auth.ts	Fixed case-sensitivity bug: public-methods list had lowercase "post"; Hono passes methods uppercase, so POST /users returned 401 instead of being public. Allow-list not broadened — DELETE/PUT/PATCH still require a token.
packages/shared/src/utils/pagination.ts	Implemented the paginate() stub per the 1-indexed contract (no page clamping, no empty-array special-casing).

Verification

• bun test → 22 pass / 0 fail
• bunx tsc --noEmit → exit 0, no output

Assumptions

• Field-name direction (username, not userName): forced by the test files, which are off-limits to edit — they call db.users.create({ username: ... }) and assert body.username.
• bun-types for tsconfig: used the already-installed root devDependency rather than adding @types/node, honouring the no-new-deps constraint.

Note (out of scope — flagged, not changed)

The auth middleware treats POST as public, so POST /users creates records (email/username = personal information) with no token, and there's a hardcoded "test-token" fallback when API_TOKEN is unset. Current tests pin this behaviour in place, so changing it would require test edits that were off-limits. Worth follow-up if this reaches a real deployment (relevant: ISM-1546, ES8 MFA, APP 11).