Replace free-text institution entry with a searchable bank picker

GET /api/banking/institutions lists the banks Enable Banking can connect
for a country (personal AIS, connectable consents only), with logos
restricted to https Enable Banking hosts to match the CSP image
allowlist. The connect form offers a filterable dropdown with bank
logos, falling back to the previous free-text input when the list is
unavailable or banking is not configured.

internal/app/consent_test.go

@@ -23,6 +23,10 @@ func (b *historyBank) Authorize(_ context.Context, _, _, state string) (string,
 	return "https://bank.example/authorize", nil
 }
 
+func (b *historyBank) Institutions(context.Context, string) ([]banking.Institution, error) {
+	return []banking.Institution{{Name: "N26", Country: "DE"}}, nil
+}
+
 func (b *historyBank) Transactions(_ context.Context, account domain.Account, from, to string, _ bool) ([]domain.Facts, error) {
 	b.fromDates = append(b.fromDates, from)
 	var rows []domain.Facts

internal/app/import.go

@@ -203,6 +203,21 @@ func (a *App) Authorize(ctx context.Context, institution, country string, histor
 	}
 	return url, err
 }
+
+// Institutions lists connectable banks for the country so the UI can offer
+// a picker instead of free-text entry. Provider failures stay sanitized.
+func (a *App) Institutions(ctx context.Context, country string) ([]banking.Institution, error) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if a.bank == nil {
+		return nil, errors.New("Enable Banking is not configured")
+	}
+	list, err := a.bank.Institutions(ctx, country)
+	if err != nil {
+		return nil, bankFailure(err, "institution list unavailable; retry")
+	}
+	return list, nil
+}
 func normalizedIBAN(s string) string { return strings.ToUpper(strings.Join(strings.Fields(s), "")) }
 func connectAccounts(d *domain.Dataset, session *banking.Session, reconnect bool) {
 	for i, account := range session.Accounts {

internal/app/sync_test.go

@@ -24,6 +24,9 @@ type bankScenario struct {
 func (b *bankScenario) Authorize(context.Context, string, string, string) (string, error) {
 	return "https://bank.example/authorize", nil
 }
+func (b *bankScenario) Institutions(context.Context, string) ([]banking.Institution, error) {
+	return []banking.Institution{{Name: "N26", Country: "DE"}}, nil
+}
 func (b *bankScenario) Exchange(context.Context, string) (banking.Session, error) {
 	return b.session, nil
 }