Tax rate is applied correctly based on customer location jurisdiction

A single hardcoded tax rate applied to every location — 8.5% regardless of whether the customer is in California, a no-sales-tax state like Oregon, or a VAT jurisdiction in the EU — is both a CWE-682 calculation error and a regulatory compliance failure. South Dakota v. Wayfair (2018) established economic nexus, meaning multi-state sellers must collect destination-state rates. EU VAT Directive 2006/112/EC imposes separate VAT obligations for digital and physical goods sold in EU member states. Overcharging customers in no-tax jurisdictions exposes the business to refund liability; undercharging in mandatory-tax states exposes it to audit penalties and back-tax assessments.

Implement jurisdiction-aware tax lookup in lib/tax.ts using a tax service API or a local rate table with at least 5 distinct jurisdiction entries:

// lib/tax.ts
async function getTaxRate(address: Address): Promise<number> {
  // Option 1: TaxJar (handles Wayfair nexus + VAT automatically)
  const result = await taxjar.rates.get(address.zip, {
    state: address.state,
    country: address.country,
  })
  return result.combined_rate

  // Option 2: Local table (must cover all states you serve)
  const key = `${address.country}-${address.state}`
  return TAX_RATES[key] ?? 0
}

Never return a hardcoded constant from getTaxRate. If using a local table, ensure it includes at least your nexus states and correctly maps zero-rate jurisdictions (OR, MT, NH, DE, AK) to 0.