fix: resolve failing tests and type errors

[stooit]

Summary

• shared/pagination: implemented paginate (slice by page/size; totalPages 0 for empty input; empty data for out-of-range pages).
• api/auth middleware: public-method allow-list was ["GET","post"], so POST never matched; fixed to uppercase and normalise c.req.method before comparison. Non-listed methods still require a token.
• shared/types: renamed User.userName → username to match all usages (routes and tests).
• api/routes/users: added missing badRequest import (was a runtime ReferenceError instead of 400).
• tsconfig: added "types": ["bun-types"] (already installed) to resolve bun:test / process type errors.

Verification

bun test → 22 pass, 0 fail; tsc --noEmit → clean.

Assumptions

• Tests are the source of truth for the username field name and that POST is intentionally unauthenticated.
• No test files modified; no dependencies added.

Follow-ups (out of scope)

• auth.ts falls back to a hardcoded "test-token" when API_TOKEN is unset — should fail closed.
• bun-types pinned to latest with no lockfile.