[stooit]

Fixes all failing tests and type errors (bun test 22/22, tsc --noEmit clean).

• auth middleware: the public-methods list used "post" instead of "POST". POST stays unauthenticated by design because auth.test.ts expects an unauthenticated POST /users to return 201. This means anyone can write to every POST route.
• users route: added the missing badRequest import.
• shared types: renamed User.userName to username.
• pagination: implemented paginate(); it throws RangeError when page/size are not positive integers.
• tsconfig: added types bun-types (already a devDependency).
• Removed the outdated BUG/TODO comments from the source files.

Not fixed (out of scope, no test requires it): auth.ts falls back to the token "test-token" when API_TOKEN is unset, and the token comparison isn't constant-time. Fix both before deploying anywhere other than tests. A stale BUG comment is left in auth.test.ts because test files weren't to be modified.