fix: resolve failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all 9 failing tests and clears all tsc --noEmit type errors in this multi-package Hono API. bun test is now 22 pass / 0 fail and npx tsc --noEmit exits clean. No test files were modified and no dependencies were added.

Root causes & fixes

• Auth middleware (packages/api/src/middleware/auth.ts) — the public-methods allow-list compared 'post' (lowercase) against Hono's uppercase c.req.method, so the case-sensitive includes() never matched and POST /users was incorrectly treated as protected. Fixed 'post' → 'POST'.
• Shared types (packages/shared/src/types.ts) — User.userName renamed to username to match what the (frozen) tests and the db.users.create contract expect. No other source files referenced the old name.
• Users route (packages/api/src/routes/users.ts) — badRequest was used but not imported; added it to the existing import from ../lib/errors.
• Pagination (packages/shared/src/utils/pagination.ts) — implemented the paginate() stub: correct page slice, total, totalPages (empty-array → 0), page, and pageSize. Verified against all 7 pagination tests including out-of-range and empty-array cases.
• tsconfig.json — added typeRoots so process (@types/node) and the bun:test module resolve under tsc --noEmit, without adding dependencies. Uses stable, non-version-pinned paths so it won't break on dependency bumps in CI.

Verification

• bun test → 22 pass / 0 fail
• npx tsc --noEmit → exit 0

Assumptions

• POST /users (registration) is intended to be public — consistent with the existing allow-list intent and the test POST /users is public (no token required).
• username is the canonical field name (tests are the source of truth and could not be edited).