fix: resolve all test failures and type errors across api and shared packages

[stooit]

Summary

• Auth middleware: Fixed case-sensitivity bug where publicMethods contained lowercase "post" but HTTP methods arrive as uppercase "POST", causing authenticated routes to reject valid public requests
• Shared types: Renamed userName field to username in the User type to match what route handlers and tests expect
• Pagination utility: Implemented the paginate<T>() function (was throwing "not implemented") with proper page slicing, bounds handling, and metadata
• Users route: Added missing badRequest helper import and replaced process.env with Bun-compatible env access
• Type declarations: Added bun.d.ts ambient declarations for bun:test module and process global so tsc --noEmit passes without modifying test files

Verification

All 22 tests pass (bun test) and zero TypeScript errors (npx tsc --noEmit).

Assumptions

• The User type's field was intentionally named username (matching tests and route handlers) — the userName variant was the bug
• badRequest helper didn't exist; created a minimal one returning c.json({ error: message }, 400)
• Bun's process.env is available at runtime but needs ambient declarations for tsc