fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all failing tests and type errors in the Bun + Hono TypeScript monorepo. bun test → 22 pass / 0 fail; tsc --noEmit → clean (exit 0).

No test files, package.json, or lockfiles were modified. No dependencies added.

Root-cause fixes

Area	Bug	Fix
packages/api/src/routes/users.ts	badRequest used but not imported → ReferenceError turned the missing-fields case into a 500 instead of 400	Added badRequest to the existing import from ../lib/errors
packages/shared/src/types.ts	User.userName inconsistent with the { username } shape the DB layer and tests use (TS2561)	Renamed field to username — fixes it at the source of truth rather than casting at call sites
packages/api/src/middleware/auth.ts	Public-methods allow-list contained lowercase "post"; HTTP verbs are case-sensitive so POST wrongly required a token (401 instead of 201)	Corrected literal to "POST". Comparison is against literal verbs (fail-closed)
packages/shared/src/utils/pagination.ts	paginate() was an unimplemented stub (7 failing tests)	Implemented: slicing, total/totalPages (0 for empty array), page/pageSize echo, [] for out-of-range pages
tsconfig.json	bun-types (already a devDependency) was never wired into compiler options → TS2580 process, TS2307 bun:test	Added "types": ["bun-types"] — uses an existing devDependency, adds nothing new

Review notes / assumptions

• Reviewed by the review subagent: no blockers. A first pass had added a .toUpperCase() normalisation to the auth method check; that was scope creep in a security-relevant path and biased fail-open, so it was removed — the allow-list now matches literal verbs and all 22 tests still pass.
• Known residual (out of scope, not test-required, flagged not fixed):
  • paginate() does not guard against NaN/Infinity inputs. It has no call site today, so no untrusted-input path exists — a Number.isFinite guard is recommended before wiring it to query params.
  • POST /users is intentionally public per auth.test.ts — an unauthenticated write path would not meet ISM-1546 in a production service. Preserved as the tests define it.
  • process.env.API_TOKEN ?? "test-token" is a hardcoded default credential (ISM-1685); safe here because tests set API_TOKEN, but should fail-closed in production.

Verification

bun test      → 22 pass, 0 fail, 37 expect() calls
tsc --noEmit  → exit 0, no errors