fix: resolve failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all failing tests (bun test) and eliminates all type errors (tsc --noEmit) in the Bun + Hono monorepo. Baseline was 13 pass / 9 fail with 14 tsc errors; now 22 pass / 0 fail and tsc exits 0.

Fixes

• Auth middleware (packages/api/src/middleware/auth.ts) — the public-method allow-list contained "post" (lowercase) while c.req.method yields POST, so POST /users fell through to the token check and returned 401 instead of being public. Corrected the literal and made the comparison case-insensitive.
• Shared type inconsistency (packages/shared/src/types.ts) — User.userName renamed to User.username to match what route handlers and tests expect. This was the source of the Omit<User, ...> tsc errors.
• Missing import (packages/api/src/routes/users.ts) — badRequest was called but not imported, throwing a ReferenceError surfaced as 500 instead of the intended 400 on the missing-fields path. Added it to the existing ../lib/errors import.
• Pagination utility (packages/shared/src/utils/pagination.ts) — implemented paginate<T>() (previously a throwing stub) to satisfy the full contract: 1-indexed page slicing, total/totalPages (0 for empty arrays), page/pageSize echo, empty data for out-of-range pages.
• tsconfig (tsconfig.json) — added "types": ["bun-types"] so the process global and bun:test module declarations resolve. bun-types was already a devDependency; no new dependency added.

Constraints honoured

• No test files modified. No new dependencies added. Only the five source/config files above changed.

Verification

• bun test → 22 pass / 0 fail
• bunx tsc --noEmit → exit 0

Assumptions / notes

• The auth policy makes POST public — deliberately encoded in the tests, so preserved. For a real deployment, unauthenticated writes and the non-constant-time token compare at auth.ts:25 warrant a security pass (out of scope here).
• paginate defensively clamps non-finite / sub-1 size to 1; no test or caller exercises those inputs.

🤖 Generated with QuantCode