Decoupling audit: remove cart API, update shared submodule

- Delete bp/cart/api.py (dead internal API endpoint)
- Remove registration from bp/__init__.py and app.py
- Update shared submodule

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app.py

@@ -13,7 +13,6 @@ from bp import (
     register_cart_overview,
     register_page_cart,
     register_cart_global,
-    register_cart_api,
     register_orders,
 )
 from bp.cart.services import (
@@ -145,9 +144,6 @@ def create_app() -> "Quart":
     # --- Blueprint registration ---
     # Static prefixes first, dynamic (page_slug) last
 
-    # Internal API (server-to-server, CSRF-exempt)
-    app.register_blueprint(register_cart_api())
-
     # Orders blueprint
     app.register_blueprint(register_orders(url_prefix="/orders"))