bug: fix cart "Subtotal" label that included shipping fee

[devin-ai-integration]

Summary

The cart footer showed a single line labeled "Subtotal" whose value silently included shipping — the same mislabeling found during the ThriftBooks audit (where "Cart subtotal" actually displayed the shipping-inclusive grand total). A shopper saw Subtotal: $61 for a $56 item with no indication that $5 shipping was baked in.

This PR makes the cart breakdown explicit and correctly labeled:

- <h3>Subtotal:</h3>  <h3>${totalPrice + SHIPPING_FEE}</h3>   // "Subtotal" but includes shipping
+ <h3>Subtotal:</h3>  <h3>${totalPrice}</h3>                   // items only
+ <h3>Shipping:</h3>  <h3>${SHIPPING_FEE}</h3>
+ <h3>Total:</h3>     <h3>${totalPrice + SHIPPING_FEE}</h3>    // emphasized grand total

• Subtotal now reflects items only (totalPrice).
• Shipping is a separate line driven by a new SHIPPING_FEE constant in lib/utils.js.
• Total (items + shipping) is shown as the emphasized grand total via a .total-due style, matching what Stripe actually charges.

Notes

• SHIPPING_FEE is a flat constant for demo purposes (the existing Stripe flow already attaches a shipping rate at checkout); the value just needs to align conceptually.
• The first commit reproduces the bug; the second commit fixes it, so the net diff is the fix.

Before / After

Before — single line labeled "Subtotal: $61" for a $56 item (shipping hidden inside):

After — itemized Subtotal $56 / Shipping $5 / Total $61:

Link to Devin session: https://app.devin.ai/sessions/decb8eb7a1d54b3d925f5f1459fb4a64
Requested by: @davidbean-hash

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

💡 Connect your GitHub account to enable automatic code reviews.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring