Authorize consents for the account-holder type the bank supports

Kontist authorized but shared no accounts: psu_type was hardcoded to
personal, and Enable Banking documents that a psu_type mismatch can
yield a consent without the expected accounts. The bank listing now
reports each institution's supported psu_types, the connect form offers
only those, the chosen type reaches POST /auth, and an unsupported
combination is refused before the user is sent to a bank. The choice is
stored per consent so reconnecting reuses it; consents predating the
choice stay personal.

Also repairs the frontend derivation, which the Montserrat dependency
broke: npmDepsHash was stale and web/public was missing from the
fileset, so the traced duck icon never reached the built assets.

nix/package.nix

@@ -27,6 +27,7 @@ let
       root = ../web;
       fileset = lib.fileset.unions [
         ../web/src
+        ../web/public
         ../web/index.html
         ../web/package.json
         ../web/package-lock.json
@@ -34,7 +35,7 @@ let
         ../web/vite.config.ts
       ];
     };
-    npmDepsHash = "sha256-Sq4qmgNpg8b3fN8v1QHiISMQt5ZHI6oZ8J0M5svV0Ys=";
+    npmDepsHash = "sha256-u1pe2mJk8eyzzyZ1O55kxUhxdpHRCIyGOeuuP1RILFs=";
     npmFlags = [ "--ignore-scripts" ];
     installPhase = ''
       runHook preInstall