[stooit]

Summary

• shared/pagination: implemented paginate (slice by page/size; returns data, page, pageSize, total, totalPages).
• shared/types: renamed User.userName → username to match api usage and tests.
• api/routes/users: added missing badRequest import.
• api/middleware/auth: public-methods list compared against uppercase c.req.method; fixed "post" → "POST".
• tsconfig: added "types": ["bun-types"] (already present in node_modules; no new deps) to resolve bun:test / process types.

bun test: 22 pass / 0 fail. tsc --noEmit: clean. No test files modified.

Assumptions / follow-ups (not changed — out of scope "fix only what tests require")

• Auth policy follows the middleware's documented intent (GET, POST public). This makes all POST routes public, including POST /posts; consider restricting public POST to /users only.
• paginate does not validate page < 1 or size <= 0 (no callers yet); consider clamping before wiring to query params.
• Stale // BUG: comments remain in edited files.