fix: resolve failing tests and type errors - #299

Summary

• auth middleware: publicMethods had "post", which never matched c.req.method ("POST"). Changed it to "POST".
• shared types: renamed User.userName to username to match the db, the routes and the tests.
• users route: added the missing badRequest import. Its absence caused a ReferenceError, so the endpoint returned 500 instead of 400.
• pagination: implemented paginate to the contract in the test.
• tsconfig: added "types": ["bun-types"], which resolves the bun:test and process errors. bun-types is already installed.
• Removed the stale BUG/TODO comments from source files. Test files are unchanged.

Verification

bun test passes 22/22, with 0 failures. tsc --noEmit reports no errors.

Assumptions / review notes

• ⚠️ Security sign-off needed: every POST route is now unauthenticated, including POST /users and POST /posts. That is the policy documented in auth.ts and asserted by auth.test.ts, so I kept it to stay within "don't modify tests". It does let anyone create users, and create posts under any authorId. Any new POST route will also be public by default. Consider allowing specific route+method pairs instead.
• Not part of this change: process.env.API_TOKEN ?? "test-token" falls back to a hardcoded token when API_TOKEN is unset. It should fail closed instead.
• paginate does not validate page < 1 or size <= 0, because the tests don't require it.