[stooit]

Summary

• api/middleware/auth.ts: public-methods list had lowercase "post", so POST never matched; now "POST" (policy comment and tests expect public POST).
• api/routes/users.ts: added missing badRequest import (runtime ReferenceError + tsc error).
• shared/types.ts: renamed User.userName → username to match routes/tests.
• shared/utils/pagination.ts: implemented paginate (1-indexed pages, totalPages = ceil(total/size), empty data for out-of-range pages).
• tsconfig.json: added "types": ["bun-types"] (already a devDependency) so tsc resolves bun:test/process.

Result: bun test 22/22 pass, tsc --noEmit clean.

Assumptions / follow-ups (not changed — out of scope "fix only what tests require")

• paginate does not validate negative/zero/non-integer page/size; no caller passes user input yet. Recommend adding guards + tests before wiring into routes.
• Pre-existing: auth.ts falls back to hard-coded "test-token" when API_TOKEN is unset and uses non-constant-time compare; bun-types is pinned to latest.
• Stale // BUG / TODO comments left in place.
• Planning step was folded into the implementation agent given the 20-minute limit; changes were independently reviewed (no critical/high findings).