Reduce duplicate cart reads on checkout shipping mutation paths

[mzaintariq]

Fixes #463

Summary

Reduces duplicate cart reads after shipping-related cart mutations while preserving
the existing server-authoritative payment flow.

Changes:

• Reuse the cart returned by applyShippingSelection / setCartShippingLine in
  /pay and update-session instead of performing an additional getACart only
  to refresh totals.
• Have clearCartShippingLine report deletedCount; on non-shipping /pay,
  skip the post-clear total fetch when no managed __ep_shipping lines were
  removed, while still refreshing totals after an actual cart mutation.
• Preserve shipping re-assertion, server-owned amounts, cart hash behavior, and
  #436 stale __ep_shipping cleanup.

No changes to:

• shipping resolution
• client-provided amounts
• physical checkout behavior
• payment authority boundaries

Test plan

• Focused Jest suites for pay, security-regression, update-session,
  and set-shipping-line
• Physical pay still re-asserts shipping and charges the server-resolved rate
• Digital cart without __ep_shipping skips unnecessary post-clear total fetch
• Digital cart with stale __ep_shipping clears the line, refreshes totals,
  and preserves correct free/paid behavior
• Selecting a shipping rate refreshes session totals without an extra cart GET