[stooit]

Summary

• auth.ts: public-methods list had lowercase "post", so POST /users returned 401 → now "POST".
• users.ts: added missing badRequest import (caused 500 instead of 400).
• shared/types.ts: renamed User.userName → username to match api package and tests.
• shared/utils/pagination.ts: implemented paginate (1-indexed page; returns data, total, totalPages, pageSize).
• tsconfig.json: added "types": ["bun-types"] (already installed) to resolve bun:test/process type errors.

Result: 22/22 tests pass, tsc --noEmit exits 0. No test files modified, no dependencies added.

Assumptions / follow-ups

• POST being public is per the documented policy and tests.
• paginate doesn't validate size<=0/fractional inputs — not required by tests; worth clamping before wiring to query params.
• Pre-existing (not changed): hard-coded test-token fallback in auth, non-constant-time token compare, unpinned bun-types: latest. Stale "BUG" comments left to keep diff minimal.