fix: repair failing tests and type errors across api & shared packages

[stooit]

Summary

Fixes all failing tests (22/22 now pass) and all tsc --noEmit errors (exit 0) across the multi-package Bun + Hono repo. Bugs spanned both the api and shared packages, matching the four investigation areas in the task.

Changes

• Pagination utility (packages/shared/src/utils/pagination.ts): implemented paginate(), which was a stub that threw not implemented. Now returns the correct page slice plus total, totalPages, page, and pageSize; handles out-of-range pages, empty arrays, and partial last pages.
• Shared types (packages/shared/src/types.ts): renamed User.userName → username so the field name is consistent across both packages and matches what the (unmodifiable) tests assert on.
• Auth middleware (packages/api/src/middleware/auth.ts): fixed a case-sensitivity bug in the public-route HTTP method comparison so POST /users is correctly treated as public (no token required).
• Users route (packages/api/src/routes/users.ts): added the missing badRequest import that was causing a runtime failure / TS2552, and aligned the create-user field with the renamed username.
• tsconfig (tsconfig.json): scoped the types so bun:test and node globals (process) resolve — no new dependencies added (used what was already in node_modules).

Verification

• bun test → 22 pass / 0 fail across 4 files
• bunx tsc --noEmit → exit 0
• Independent review pass confirmed pagination edge cases, the narrow scope of the auth fix, and that the tsconfig change is a scoped resolution fix (not a type-safety weakening).

Constraints honoured

• No test files modified
• No new dependencies added
• Only changes required by the tests/type-checker (plus stale TODO/BUG comment cleanup)

Assumptions

• Canonical user field name is username (not userName) because the unmodifiable test files assert on username; all non-test source was updated to match.
• Out-of-scope contract hardening not exercised by any test (e.g. pageSize <= 0 behaviour) was intentionally left unchanged to respect the "fix only what tests require" constraint.