fix: resolve failing tests and type errors - #291

Summary

• auth middleware: public-method allow-list had lowercase "post"; Request normalises methods to uppercase, so POST never matched → now "POST".
• users route: added missing badRequest import from ../lib/errors.
• shared types: renamed User.userName → username to match db, routes and tests.
• pagination: implemented paginate (was a throwing stub) returning data, page, pageSize, total, totalPages.
• tsconfig: added "types": ["bun-types"] (already installed) to fix bun:test/process type errors.

Verification

bun test → 22 pass / 0 fail; tsc --noEmit → clean. No test files modified, no dependencies added.

Assumptions / follow-ups (from review, not addressed — out of scope)

• paginate does not validate page/size ≤ 0 or non-integers; add validation before wiring to query params.
• auth.ts falls back to hard-coded "test-token" when API_TOKEN unset, uses non-constant-time compare; HEAD/OPTIONS require a token.
• Stale BUG/TODO comments left in place.
• bun-types is latest in package.json — consider pinning.