[stooit]

Summary

• tsconfig.json: add "types": ["bun-types"] (already installed) so bun:test and process resolve under tsc.
• shared/types.ts: rename User.userName → username to match the API routes and tests.
• api/routes/users.ts: add the missing badRequest import.
• api/middleware/auth.ts: fix case-sensitivity bug — publicMethods contained "post" but Hono reports uppercase methods; now "POST".
• shared/utils/pagination.ts: implement paginate() (1-indexed pages, totalPages = ceil(total/size), empty data past the end). Page/size are normalised to integers ≥ 1 so bad input can't produce Infinity/NaN or bypass the size limit.
• Removed stale // BUG: comments.

Result: bun test 22/22 pass; tsc --noEmit clean.

Assumptions / notes for reviewers

• Security policy flag: the auth fix makes POST requests unauthenticated on all routes (POST /users, POST /posts). This matches the middleware doc comment and auth.test.ts ("POST is intentionally public"), which can't be modified, so I treated it as intended. Before this behaviour is relied on in production, the owner should confirm that unauthenticated writes are acceptable.
• Edge-case input normalisation in paginate() goes beyond what the tests require and has no dedicated tests yet.
• Leftover stale comments: a "TODO: implement this function" line in the pagination.ts docblock, and a comment in auth.test.ts:21, which is a test file and was left untouched.