Authorize consents for the account-holder type the bank supports

Kontist authorized but shared no accounts: psu_type was hardcoded to
personal, and Enable Banking documents that a psu_type mismatch can
yield a consent without the expected accounts. The bank listing now
reports each institution's supported psu_types, the connect form offers
only those, the chosen type reaches POST /auth, and an unsupported
combination is refused before the user is sent to a bank. The choice is
stored per consent so reconnecting reuses it; consents predating the
choice stay personal.

Also repairs the frontend derivation, which the Montserrat dependency
broke: npmDepsHash was stale and web/public was missing from the
fileset, so the traced duck icon never reached the built assets.

internal/app/sync_test.go

@@ -21,7 +21,7 @@ type bankScenario struct {
 	fail    bool
 }
 
-func (b *bankScenario) Authorize(context.Context, string, string, string) (string, error) {
+func (b *bankScenario) Authorize(context.Context, string, string, string, string) (string, error) {
 	return "https://bank.example/authorize", nil
 }
 func (b *bankScenario) Institutions(context.Context, string) ([]banking.Institution, error) {