[stooit]

Summary

• auth middleware: the list of public methods had "post" (lowercase), so POST never matched. It now uses "POST". PUT, PATCH and DELETE still require a token.
• shared types: renamed User.userName to username to match the routes and tests.
• users route: added the missing badRequest import from ../lib/errors.
• pagination: implemented paginate() to satisfy packages/shared/test/pagination.test.ts.
• tsconfig: added "types": ["bun-types"] so bun:test and process resolve. bun-types was already installed, so no dependency was added.

Verification

bun test && tsc --noEmit passes: 22 tests pass, 0 fail, and there are no type errors. No test files were modified.

Assumptions / follow-ups

• Making POST public is intended. The test, the policy comment in auth.ts and the README all say so. It does allow unauthenticated writes to /users and /posts.
• paginate() does not validate its inputs. Following the "fix only what tests require" constraint, I didn't add validation; nothing calls paginate() yet. Before it is wired to query params, it should reject page < 1, size <= 0 and non-integer values. For example, a negative page currently returns wrong items, and size 0 gives a NaN or Infinity page count.
• The old // BUG: comments in auth.ts and users.ts were left in place and are now outdated.