fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all failing tests (22 pass, 0 fail) and eliminates all tsc --noEmit type errors across the api and shared packages.

Changes

• Auth middleware (packages/api/src/middleware/auth.ts): replaced a case-sensitive lowercase string comparison with an uppercase HTTP-method allow-list checked against c.req.method (which Hono normalises to uppercase). POST /users is now correctly treated as a public route.
• Shared types (packages/shared/src/types.ts): canonicalised the User field name to username, matching what the tests and API routes expect, resolving the cross-package inconsistency.
• Pagination utility (packages/shared/src/utils/pagination.ts): implemented the previously-stubbed paginate<T>(items, page, size) with correct page-slice, partial-last-page, out-of-range, empty-input, and totalPages handling per the test contract.
• Route handlers (packages/api/src/routes/users.ts): added the missing badRequest import and aligned the field name.

Verification

• bun test -> 22 pass, 0 fail
• npx tsc --noEmit -> clean (exit 0)
• Independent review pass: approved, no blocking issues.

Assumptions

• Canonical User field name is username (the form the tests assert against).
• No test files were modified and no new dependencies were added, per task constraints.

Notes

• A reviewer flagged one pre-existing, non-blocking edge case (no change required for the tests to pass); left untouched to keep the fix scoped to what the tests require.