fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Makes bun test (22 pass, 0 fail) and npx tsc --noEmit (exit 0) fully clean. Bugs spanned both the api and shared packages.

Root causes & fixes

• Pagination (packages/shared/src/utils/pagination.ts) — paginate<T>() was a stub that threw not implemented. Implemented slicing by (page-1)*size, with total, totalPages (Math.ceil), page/pageSize fields, and correct handling of out-of-range pages (empty data) and empty input arrays.
• Auth middleware (packages/api/src/middleware/auth.ts) — HTTP method comparison was case-sensitive, so the public POST /users route incorrectly required a token. Normalised the method comparison so public-route matching is casing-robust. Also resolved a Cannot find name 'process' type error.
• Shared types (packages/shared/src/types.ts + packages/api/src/routes/users.ts) — the User field name was inconsistent between packages; the route used username against a differently-named field. Aligned to the field name the tests treat as authoritative.
• Missing import (packages/api/src/routes/users.ts) — badRequest response helper was referenced but not imported; added the import so POST /users returns 400 for missing fields.
• tsconfig.json — minimal types adjustment so tsc resolves Bun globals without adding dependencies. No strictness weakened and no skipLibCheck masking.

Verification

• bun test → 22 pass, 0 fail
• npx tsc --noEmit → exit 0

Constraints honoured

• No test files modified
• No dependencies added
• Only source needed by the tests was changed

Assumptions

• The tests are the authoritative contract; where field names conflicted, source was aligned to what the tests expect.
• Pagination input-guard edge cases (page < 1, size <= 0) are not exercised by tests, so left minimal per the "fix only what tests require" constraint.

🤖 Generated with autonomous agent