fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Repairs all 9 failing tests and all 14 TypeScript errors in the multi-package repo. Result: bun test → 22 pass / 0 fail, bunx tsc --noEmit → clean (exit 0).

No test files were modified and no dependencies were added — fixes are confined to source and tsconfig only.

Fixes (5 files)

File	Fix
packages/shared/src/utils/pagination.ts	Implemented the stubbed paginate<T>(). 1-indexed pages; partial last page returned as-is; out-of-range or invalid page/size → empty data; empty input → totalPages: 0.
packages/api/src/middleware/auth.ts	Case-sensitivity bug: publicMethods had "post" — c.req.method is uppercased, so POST was wrongly token-gated. Changed to "POST".
packages/shared/src/types.ts	Renamed User.userName → username to match the API consumers and the (unmodifiable) tests, which assert the serialised field is username.
packages/api/src/routes/users.ts	Imported the existing badRequest helper from ../lib/errors (mirrors routes/posts.ts), fixing a ReferenceError on the missing-fields path.
tsconfig.json	Added "types": ["bun-types"] so bun:test and process resolve. bun-types was already a devDependency — no new dependency.

Verification

bun test          → 22 pass, 0 fail
bunx tsc --noEmit → exit 0, no errors

Assumptions & notes

• Canonical field name is username. The test files (which the task forbids editing) assert on username in request/response bodies, so the shared type was conformed to the tests.
• Auth surface widened by exactly one method (POST), matching the documented policy in the middleware. GET + POST are public; PUT/PATCH/DELETE remain token-gated (verified — DELETE without a token still returns 401).
• paginate hardening beyond the tests: the implementation guards page < 1 and size < 1 to return empty data (consistent with the out-of-range contract), avoiding a trap for the first real caller. All existing tests pass unchanged.

Out of scope (pre-existing, flagged by review — not addressed here)

• auth.ts uses a hardcoded "test-token" fallback when API_TOKEN is unset, and a non-constant-time token comparison (CWE-798 / timing). Pre-existing; a "fix failing tests" task correctly leaves it untouched. Worth a follow-up before any real deployment.
• HEAD/OPTIONS are token-gated (OPTIONS gating would break CORS preflight). Pre-existing.

🤖 Generated with QuantCode Agent