fix: repair failing tests across api and shared packages

[stooit]

Summary

Fixes all failing tests and type errors in the Bun + Hono TypeScript API. The suite now passes 22/22 with 0 tsc --noEmit errors (baseline: 13 pass / 9 fail, 14 type errors).

Bugs spanned both the api and shared packages:

• Pagination utility (packages/shared/src/utils/pagination.ts) — implemented the paginate() stub that previously threw not implemented. Returns the correct data slice plus page, pageSize, total, and totalPages (Math.ceil, so an empty array yields totalPages: 0).
• Shared type field mismatch (packages/shared/src/types.ts) — renamed User.userName → username to match the API route handlers and the (immutable) tests. db.ts inherits the change via its Omit<User, ...> spread.
• Missing import (packages/api/src/routes/users.ts) — badRequest was used but not imported, causing a ReferenceError that surfaced as a 500 on validation instead of the expected 400. Added it to the existing ../lib/errors import.
• Auth middleware case-sensitivity (packages/api/src/middleware/auth.ts) — the public-methods allow-list had "post" (lowercase); Hono surfaces HTTP methods uppercase per RFC 9110, so POST /users was incorrectly requiring a token. Changed to "POST".
• Type config (tsconfig.json) — added compilerOptions.types: ["bun-types"] to resolve bun:test and process type errors. bun-types was already a devDependency, so no new dependency was added.

Testing

• bun test → 22 pass / 0 fail
• bunx tsc --noEmit → clean (exit 0), verified the checker is still engaged (a deliberate temporary type error was correctly flagged, then reverted)

Constraints honoured

• No test files modified (exactly 5 source files changed)
• No dependencies added
• Only what the tests require was fixed

Assumptions & out-of-scope notes

• paginate() was implemented with no clamping of page/size, matching the contract exercised by the tests. It has no production caller today (only re-exported + tested). A latent edge case exists if it is ever wired directly to unvalidated ?page=/?size= query params (e.g. size: 0 → totalPages: Infinity); recommend a route-boundary clamp when that happens. Left unchanged to keep this fix minimal.
• Activating public POST is the explicitly intended policy per auth.ts comments and auth.test.ts ("POST is intentionally public"). The pre-existing hardcoded "test-token" fallback in the auth middleware was not introduced here and is out of scope; worth hardening before any real deployment.
• README.md still describes the four seeded bugs under "Known issues" — left as-is since it appears to be intentional test-harness scaffolding.

🤖 Generated with QuantCode Agent