feat(core,react): add the personal IBAN client contract

[TaprootFreak]

Step 1 of #198: move the personal IBAN wire contract into the packages so consumers no longer
need a local useApi() wrapper for it.

Changes

@dfx.swiss/core

• BuyUrl.personalIban (buy/personalIban)
• VirtualIban, CreateVirtualIban, VirtualIbanStatus
• BuyApi.getPersonalIbans() and BuyApi.createPersonalIban()
• Selector helpers on top of the existing PersonalIbanProvider enum: normalizePersonalIban,
  toPersonalIbanProvider, isUnrecognizedPersonalIbanSelector, toPersonalIbanProviderRequest

@dfx.swiss/react

• useVirtualIban() with getPersonalIbans / createPersonalIban
• Re-exports of the new types and helpers

Tests cover both client methods and every selector helper (buy-api.test.ts,
personal-iban.test.ts).

Notes

• Both endpoints are covered, not just create. The API exposes GET buy/personalIban next to
  POST buy/personalIban; the list endpoint is part of the same customer contract, so freezing only
  the create half would leave consumers writing a local wrapper anyway.
• acceptsPayments is part of the response. The API returns it (whether the bank behind the IBAN
  currently accepts payments, independent of active). Consumers that modelled this response locally
  without that field silently dropped it.
• The selector helpers are provider-generic. They match case-insensitively against the
  PersonalIbanProvider enum instead of comparing to a single hard-coded member, so a future provider
  needs no change at the call sites. Behaviour is identical for today's enum.
• Deliberately not moved: user-facing error copy for personal IBAN failures, the
  currency/payment-method applicability rule, and the response check against a specific bank and
  account-holder name. Those encode product state that can change without a contract change, and a
  published SDK that asserts them would start lying the day the API changes. URL and widget parameter
  handling stays with the consumer as well, per the issue.

Additive only — no existing export changes shape, so there is nothing for downstream consumers to
migrate.

Version fields, changelogs and lockfile pins are untouched, per CONTRIBUTING.

[TaprootFreak]

Took 3 review passes to reach a clean run.

What came out of them:

• VirtualIbanInterface was re-exported from the react package root; none of the other hooks do that.
  Only the hook function is exported now — the type is reachable as
  ReturnType<typeof useVirtualIban>.
• A doc comment stated a concrete KYC level the API enforces. A published client should not freeze a
  policy it does not own; it now says only that rejections arrive as an ApiException.
• The "provider values" comment in react/definitions/buy.ts ended up covering five more exports it
  does not describe. It is back to covering only PersonalIbanProvider.