Authorize consents for the account-holder type the bank supports

Kontist authorized but shared no accounts: psu_type was hardcoded to
personal, and Enable Banking documents that a psu_type mismatch can
yield a consent without the expected accounts. The bank listing now
reports each institution's supported psu_types, the connect form offers
only those, the chosen type reaches POST /auth, and an unsupported
combination is refused before the user is sent to a bank. The choice is
stored per consent so reconnecting reuses it; consents predating the
choice stay personal.

Also repairs the frontend derivation, which the Montserrat dependency
broke: npmDepsHash was stale and web/public was missing from the
fileset, so the traced duck icon never reached the built assets.

internal/app/banking_settings_test.go

@@ -60,7 +60,7 @@ func bankingAuthorization(t *testing.T, a *App, key *rsa.PrivateKey, appID, redi
 		}
 		switch r.URL.Path {
 		case "/aspsps":
-			fmt.Fprint(w, `{"aspsps":[{"name":"N26","country":"DE","maximum_consent_validity":3600}]}`)
+			fmt.Fprint(w, `{"aspsps":[{"name":"N26","country":"DE","psu_types":["personal"],"maximum_consent_validity":3600}]}`)
 		case "/auth":
 			var req struct {
 				State    string `json:"state"`
@@ -87,7 +87,7 @@ func bankingAuthorization(t *testing.T, a *App, key *rsa.PrivateKey, appID, redi
 	}
 	provider.BaseURL = mock.URL
 	provider.HTTPClient = mock.Client()
-	if _, err := a.Authorize(context.Background(), "N26", "DE", 12); err != nil {
+	if _, err := a.Authorize(context.Background(), "N26", "DE", banking.PSUPersonal, 12); err != nil {
 		t.Fatal(err)
 	}
 	return pending
@@ -244,7 +244,7 @@ func TestBankingSavedCredentialsAndDisableOverrideEnvironment(t *testing.T) {
 		t.Fatal(err)
 	}
 	a = reopenBankingApp(t, a)
-	if _, err := a.Authorize(ctx, "N26", "DE", 12); err == nil {
+	if _, err := a.Authorize(ctx, "N26", "DE", banking.PSUPersonal, 12); err == nil {
 		t.Fatal("disabled saved configuration fell back to environment")
 	}
 }