[stooit]

Fixes failing tests and type errors:

• auth middleware: public-method list had lowercase post, so POST requests got a 401. It is now POST.
• users route: added the missing badRequest import. Invalid input returned a 500 instead of a 400.
• shared types: renamed User.userName to username.
• pagination: implemented paginate. Page and page size are clamped to whole numbers of at least 1, and NaN or Infinity fall back to 1.
• tsconfig: added types: ["bun-types"] (already installed).
• Removed the leftover BUG and TODO comments from the source files.

bun test: 22 pass. tsc --noEmit runs clean. No test files were changed and no dependencies were added.

Assumptions / notes

• Every POST endpoint is now public, including POST /posts, because the auth middleware applies to all routes. That matches the documented policy and the tests, but please confirm it's intended.
• Existing issues left alone because they're out of scope: auth accepts a token without the Bearer prefix, compares tokens with a normal (non-constant-time) check, and falls back to test-token when API_TOKEN is unset.