Report failed bank connections and stop resurrecting deleted accounts

Three defects made new connections silently vanish while removed
accounts returned:

- A single shared account the journal cannot represent (securities or
  card entries without IBAN, stable identification or currency) aborted
  the entire consent. Usable accounts are now linked and the rest
  counted and reported.
- A consent that linked nothing was stored, redirected as success and
  later reaped by session recovery. It now fails with the reason.
- Callback failures rendered a bare JSON error page and were never
  logged. They now log and redirect into the app with the reason shown.
- Deleting an account left its session binding, so the next connect or
  sync recovered the binding and re-added the account. Account deletion
  now releases bindings, consents and cursors before committing.

internal/app/banking_settings_test.go

@@ -116,7 +116,7 @@ func TestBankingRuntimeRotationPreservesConsentAndRejectsPendingCallback(t *test
 		t.Fatal(err)
 	}
 	pending := bankingAuthorization(t, a, key, "app-one", bankingCallback)
-	if err := a.Callback(ctx, "code", pending); err != nil {
+	if _, err := a.Callback(ctx, "code", pending); err != nil {
 		t.Fatal(err)
 	}
 	before, err := a.Snapshot(ctx)
@@ -138,7 +138,7 @@ func TestBankingRuntimeRotationPreservesConsentAndRejectsPendingCallback(t *test
 	if !reflect.DeepEqual(before.Sessions, after.Sessions) || !reflect.DeepEqual(before.Data, after.Data) || a.ops.AccountSync[accountID] == "" {
 		t.Fatal("same-application rotation discarded consent, cursor or canonical data")
 	}
-	if err := a.Callback(ctx, "code", pending); err == nil {
+	if _, err := a.Callback(ctx, "code", pending); err == nil {
 		t.Fatal("rotation accepted a stale pending callback")
 	}
 	bankingAuthorization(t, a, rotated, "app-one", callback)
@@ -168,7 +168,7 @@ func TestBankingAppSwitchAndDisableNeverReuseOldSessions(t *testing.T) {
 				t.Fatal(err)
 			}
 			pending := bankingAuthorization(t, a, key, "app-one", bankingCallback)
-			if err := a.Callback(ctx, "code", pending); err != nil {
+			if _, err := a.Callback(ctx, "code", pending); err != nil {
 				t.Fatal(err)
 			}
 			before, _ := a.Snapshot(ctx)
@@ -195,7 +195,7 @@ func TestBankingAppSwitchAndDisableNeverReuseOldSessions(t *testing.T) {
 				if !remove {
 					bankingAuthorization(t, a, key, "app-two", bankingCallback)
 				}
-				if err := a.Callback(ctx, "code", pending); err == nil {
+				if _, err := a.Callback(ctx, "code", pending); err == nil {
 					t.Fatal("old pending authorization accepted after app change")
 				}
 				if _, err := a.Balances(ctx, accountID); err == nil {
@@ -286,7 +286,7 @@ func TestBankingRejectedSettingsAndFailedWritePreserveActiveProvider(t *testing.
 	if _, err := a.RemoveBankingSettings(ctx); err == nil {
 		t.Fatal("failed removal reported success")
 	}
-	if err := a.Callback(ctx, "code", pending); err != nil {
+	if _, err := a.Callback(ctx, "code", pending); err != nil {
 		t.Fatal("failed credential write invalidated active authorization", err)
 	}
 	bankingAuthorization(t, a, key, "active-app", bankingCallback)
@@ -367,7 +367,7 @@ func TestBankingEnvironmentAppChangeInvalidatesBoundSessions(t *testing.T) {
 	a = reopenBankingApp(t, a)
 	ctx := context.Background()
 	pending := bankingAuthorization(t, a, key, "env-one", bankingCallback)
-	if err := a.Callback(ctx, "code", pending); err != nil {
+	if _, err := a.Callback(ctx, "code", pending); err != nil {
 		t.Fatal(err)
 	}
 	before, _ := a.Snapshot(ctx)