fix: resolve failing tests and type errors

[stooit]

Summary

• Implement paginate in packages/shared/src/utils/pagination.ts (guards size<=0 / page<1)
• Rename shared User.userName → username to match routes and tests
• Add missing badRequest import in packages/api/src/routes/users.ts
• Fix auth middleware HTTP-method case-sensitivity ('post' vs 'POST'); method now normalised with toUpperCase()
• Add "types": ["bun-types"] to tsconfig.json (already installed; resolves bun:test and process)

bun test: 22/22 pass. tsc --noEmit: clean. No test files changed, no deps added.

Assumptions / notes

• Fixed the type (not call sites) for username, since all consumers used username.
• Review note: the new comment in auth.ts claims case normalisation prevents bypass; it actually widens the allow-list (POST is intentionally public). Behaviour is correct; comment wording could be tightened.
• Out of scope, flagged: non-constant-time token compare and "test-token" fallback in auth; unused validate.ts middleware; bun-types: "latest" unpinned.