fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all 9 failing tests and 14 tsc --noEmit errors across the api and shared packages. Baseline was 13 pass / 9 fail with 14 type errors; now 22 pass / 0 fail and tsc --noEmit exits 0.

Changes (5 files)

File	Fix
packages/api/src/middleware/auth.ts	Uppercase POST in the public-method allow-list. c.req.method is uppercase per RFC 7231, so the lowercase "post" never matched — public writes were wrongly returning 401.
packages/shared/src/types.ts	Rename User.userName → username to match the API and test contract (field name was inconsistent between packages).
packages/api/src/routes/users.ts	Import the missing badRequest helper from ../lib/errors (was throwing a runtime ReferenceError → 500 instead of 400).
packages/shared/src/utils/pagination.ts	Implement the paginate() stub, with clamped page/size bounds.
tsconfig.json	Add "types": ["bun-types"] so bun:test imports and process resolve.

Verification

bun test          → 22 pass, 0 fail (37 expect() calls, 4 files)
npx tsc --noEmit  → exit 0, no output

Notes & assumptions

• No test files modified and no dependencies added — bun-types was already an installed devDependency, just unreferenced by the compiler.
• paginate() hardening (beyond the passing tests): the tests only exercise page: 99. I clamped the remaining edge cases so the exported public API can't lie about its contract: non-finite / sub-1 / negative page yields an empty data window; size <= 0 / NaN clamps to a floor of 1 so totalPages stays a finite non-negative integer (unclamped it produced Infinity/NaN serialising to JSON null, violating PaginatedResponse.totalPages: number).
• Security note (no action needed here): the auth casing fix widens the effective auth posture — POST /users and /posts now accept unauthenticated writes. This is the documented, test-mandated contract (auth.test.ts asserts 201 with no token) and correct for this in-memory test corpus. Flagging only so it isn't copied into a real service without revisiting the policy, since those payloads carry username/email (personal information).
• paginate currently has no call sites in the api package, so the hardening changes cannot affect any live endpoint today.