[stooit]

Summary

• shared: implement paginate per its test; rename User.userName → username to match api usage/tests.
• api: import missing badRequest in users route; fix auth middleware public-methods list ("post" → "POST") so it matches c.req.method.
• tsconfig.json: add "types": ["bun-types"] (already installed) so bun:test and process type-check.

Result: bun test 22 pass / 0 fail; tsc --noEmit clean. No test files modified, no deps added.

Assumptions / notes for reviewers

• POST being public is the documented design (auth.ts policy comment, README, auth.test.ts expects unauthenticated POST → 201). Note this permits unauthenticated writes and author spoofing on /posts — fine for this corpus, not for production.
• paginate doesn't validate page < 1 / size < 1 / non-integers; no route uses it yet and tests don't cover it.
• Pre-existing: API_TOKEN falls back to hard-coded "test-token"; HEAD isn't public. Left unchanged (out of scope).
• Stale "BUG" comments in auth.ts / users.ts / types.ts / pagination.ts now describe fixed issues and could be removed in a follow-up.