Report failed bank connections and stop resurrecting deleted accounts

Three defects made new connections silently vanish while removed
accounts returned:

- A single shared account the journal cannot represent (securities or
  card entries without IBAN, stable identification or currency) aborted
  the entire consent. Usable accounts are now linked and the rest
  counted and reported.
- A consent that linked nothing was stored, redirected as success and
  later reaped by session recovery. It now fails with the reason.
- Callback failures rendered a bare JSON error page and were never
  logged. They now log and redirect into the app with the reason shown.
- Deleting an account left its session binding, so the next connect or
  sync recovered the binding and re-added the account. Account deletion
  now releases bindings, consents and cursors before committing.

internal/app/manage.go

@@ -1,14 +1,58 @@
 package app
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"slices"
 	"strings"
 
+	"finance-duck/internal/banking"
 	"finance-duck/internal/domain"
 )
 
+// ManageRegistry applies registry management and, for account deletions, also
+// releases the account's bank bindings first: a deleted account must never be
+// resurrected by the session recovery that reconstructs interrupted connects.
+func (a *App) ManageRegistry(ctx context.Context, rev, entity, action, id, target string) (State, error) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	s, err := a.snapshot(ctx)
+	if err != nil {
+		return State{}, err
+	}
+	if rev != s.Revision {
+		return State{}, errors.New("revision conflict: reload before editing")
+	}
+	if err = Manage(&s.Data, entity, action, id, target); err != nil {
+		return State{}, err
+	}
+	// Prune bindings before the canonical commit: an interruption then leaves
+	// an unbound local account rather than a resurrected bank connection.
+	if entity == "account" {
+		changed := false
+		sessions := make([]banking.Session, 0, len(a.ops.Sessions))
+		for _, session := range a.ops.Sessions {
+			accounts := slices.DeleteFunc(slices.Clone(session.Accounts), func(account domain.Account) bool { return account.ID == id })
+			changed = changed || len(accounts) != len(session.Accounts)
+			session.Accounts = accounts
+			if len(accounts) == 0 {
+				delete(a.ops.Consents, session.ID)
+				continue
+			}
+			sessions = append(sessions, session)
+		}
+		if _, tracked := a.ops.AccountSync[id]; tracked || changed {
+			a.ops.Sessions = sessions
+			delete(a.ops.AccountSync, id)
+			if err = a.saveOps(); err != nil {
+				return State{}, err
+			}
+		}
+	}
+	return a.commit(ctx, rev, s.Data)
+}
+
 func SaveAccount(d *domain.Dataset, v domain.Account) error {
 	v.DisplayName = strings.TrimSpace(v.DisplayName)
 	if v.ID == "" {