fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all failing tests and TypeScript errors. Final state: 22/22 tests pass, tsc --noEmit clean.

Bugs fixed

• Pagination utility (shared/src/utils/pagination.ts) — implemented the paginate<T> stub (page slice, total, totalPages, page/pageSize, out-of-range → empty data, empty-array handling) per the test contract.
• Auth middleware (api/src/middleware/auth.ts) — fixed a case-sensitivity bug in the public-route method allow-list so POST /users is correctly treated as public (HTTP methods are uppercase per RFC 7231).
• Shared type mismatch (shared/src/types.ts) — aligned the User field name (userName) so source matches what the tests expect.
• Missing import (api/src/routes/users.ts) — added the missing badRequest import causing the 400-for-missing-fields handler to fail at runtime.
• tsconfig wiring (tsconfig.json) — added lib/types: ["bun-types"] so bun:test and process resolve. No new dependencies installed (bun-types was already present).

Constraints honoured

• No test files modified.
• No new dependencies added.
• Only changed what the tests required.

Assumptions / notes

• The auth public-route allow-list is intentionally case-sensitive uppercase (matches the test expectation and RFC 7231).
• paginate follows the tested contract; a defensive guard for page <= 0 was noted in review but is outside the tested contract and left unchanged to avoid scope creep.

Verification

• bun test → 22 pass, 0 fail
• npx tsc --noEmit → no errors