[stooit]

Summary

• shared: implement paginate (slice, total, page, pageSize, totalPages=ceil(total/size)); rename User.userName → username to match routes/tests.
• api: auth middleware public-methods list "post" → "POST" (methods arrive uppercase); add missing badRequest import in users route.
• tsconfig.json: add "types": ["bun-types"] (already installed) to resolve process / bun:test types.

bun test: 22 pass / 0 fail. tsc --noEmit: clean. No test files modified, no deps added.

Assumptions / review notes

• POST bypassing auth is the documented intent (auth.ts comment + auth.test.ts expects anonymous POST /users → 201). Note this now makes anonymous POST /posts with caller-supplied authorId possible — worth confirming with the owner.
• Pre-existing, out of scope: API_TOKEN falls back to "test-token" when unset (should fail closed); paginate doesn't validate page/size ≤ 0; bun-types pinned to latest.
• Stale "BUG"/"TODO" comments in source and README "Known issues" left untouched (fix-only-what-tests-require).