fix: resolve failing tests and type errors across api and shared

[stooit]

Summary

• shared/pagination: implemented paginate (was a stub) per test contract; clamps page/size to ≥1.
• api/auth middleware: publicMethods had lowercase "post"; HTTP methods are uppercase, so POST was wrongly 401'd. Fixed to "POST".
• shared/types: User.userName → username to match API routes and tests.
• api/routes/users: added missing badRequest import (runtime ReferenceError on invalid POST).
• tsconfig: added "types": ["bun-types"] (already a devDependency) to resolve bun:test and process.

Verification

bun test → 22 pass / 0 fail; tsc --noEmit → 0 errors.

Assumptions

• Tests are authoritative; no test files modified, no deps added.
• POST remaining public (unauthenticated writes) is intentional per auth.test.ts; flagged as a security concern (ISM-1546) worth revisiting outside this fix.