fix: resolve all failing tests and type errors

[stooit]

Summary

Fixes all 9 failing tests and ~14 TypeScript errors across the api and shared packages. After the change: 22/22 tests pass and tsc --noEmit exits 0.

Root causes & fixes

• Missing import (packages/api/src/routes/users.ts) — badRequest was called but never imported, throwing a ReferenceError and returning 500 instead of 400 for invalid bodies. Added the import (matching the existing pattern in posts.ts).
• Inconsistent field name (packages/shared/src/types.ts) — the shared User type declared userName, but tests and route handlers use username. Tests are the contract (and were not modified), so the shared type was renamed to username. db.ts consumes the type structurally via Omit<User, ...>, so no other changes were needed.
• Auth case-sensitivity bug (packages/api/src/middleware/auth.ts) — the public-method allowlist compared against a lowercase "post", but Hono reports HTTP methods uppercase, so POST /users incorrectly required a token (401). Fixed to uppercase POST. DELETE etc. remain protected.
• Unimplemented pagination stub (packages/shared/src/utils/pagination.ts) — implemented paginate to satisfy all 7 test assertions, including edge cases (out-of-range page → empty slice, empty array → totalPages 0).
• Type resolution (tsconfig.json) — added bun-types to compilerOptions.types so bun:test and process resolve. bun-types was already a declared devDependency and present in node_modules — no new dependency was added.

Constraints respected

• No test files modified.
• No new dependencies added (package.json / lockfile untouched).
• Changes are minimal and scoped: 5 source files, +12 / −22 (deletions are stale BUG:/TODO: comments made obsolete by the fixes).

Verification

• bun test → 22 pass / 0 fail
• bunx tsc --noEmit → exit 0
• Independent review pass confirmed the diff is correct, minimal, and breaks no other consumers.

Assumptions / notes (out of scope, latent, pre-existing)

• Widening note: with the auth fix, unauthenticated POST /users and POST /posts now succeed — this is the documented policy (auth.ts) and explicitly test-mandated. If the API later handles non-public data, unauthenticated writes should be revisited.
• paginate does not clamp negative/zero page/size (would yield Infinity/negative slices), but it has no production callers and no test exercises it — left out per "fix only what the tests require".
• Auth uses a "test-token" fallback secret and a non-constant-time comparison — pre-existing, left untouched.