[stooit]

Fixes: auth middleware POST case bug; missing badRequest import in users route; shared User.userName -> username; implemented paginate (clamps page/size >= 1); tsconfig types bun-types (already installed). Removed stale BUG/TODO source comments. 22/22 tests pass, tsc --noEmit clean.

Assumptions/notes:

• POST being public follows the middleware docstring and auth.test.ts; it lets unauthenticated users create records, so please confirm that's the intended policy.
• Pre-existing: auth falls back to 'test-token' when API_TOKEN is unset; recommend failing closed in prod.
• paginate does not guard NaN or cap size; unused by routes today.
• No new deps; no test files modified.