fix: honour nationalAccountAllowed when building an international account connection

[Superheld]

The problem

A KTI (international account connection) may carry the national fields — account
number, sub-account, bank — beside IBAN and BIC, but only where the bank permits it.
The bank declares that in HISPAS, in nationalAccountAllowed. lib-fints parses the
field into the BPD and never reads it; a grep over dist/ finds it only in the type
declaration.

This is not a new failure. #19/#20 reduced the CAMT descriptor to IBAN and BIC because
comdirect rejects anything more. #25 then reported Postbank answering 9210 Angaben zur nationalen Kontoverbindung für Identifikation erforderlich, and the reduction was
reverted — which fixed Postbank and put comdirect back where it started, which is what
1.5.0 ships. Neither bank is wrong, and neither fix could hold, because the choice was
hard-coded either way. The flag is the bank saying which one it wants.

comdirect declares nationalAccountAllowed: false in its HISPAS, and there
getAccountStatements(account, from, to) — the default call, preferCamt defaulting
to true — returns success: true with zero statements and 3010 Kontonummer ist ungültig in bankAnswers. A caller not reading those sees an empty account.

Evidence

Four HKCAZ orders, one account, same range, same session, differing only in the
descriptor; repeated on a second account, same result. Measured against released 1.5.0
through startCustomerOrderInteraction — no patched library involved.

Descriptor sent	Bank answer	Statements
IBAN + BIC + number + sub-account + bank	3010 Kontonummer ist ungültig	0
IBAN + BIC	0020 Auftrag ausgeführt	19
IBAN	0020 Auftrag ausgeführt	19
number + sub-account + bank	3010 Kontonummer ist ungültig	0

The last row is why this is a rule about the national fields rather than about the
combination: they are rejected inside a KTI even with no IBAN beside them. phpFinTS
(MIT) and python-fints apply the same rule; that is where I found the flag, no code
was taken from either.

What I decided

1. A bank announcing no HISPAS keeps both halves, as today. The specification
   would read absent permission as no permission, but shortening a silent bank's
   descriptor is the move that had to be taken back in June. Only an explicit false
   shortens, so nothing working today can regress on a rule its bank never stated.
2. An account without an IBAN keeps the national fields regardless — nothing else
   identifies it. Reasoned, not measured.
3. The descriptor is built field by field rather than by spreading the whole
   BankAccount and blanking what does not belong — hence the HKSAL v6 and HKWPD
   tests changing shape although their output is identical. Happy to drop it.

Scope: HKCAZ always builds a KTI, HKSAL and HKKAZ from segment version 7, HKEKA from
version 4, so all five interactions go through one function. Only HKCAZ was
exercised against a bank — this one announces HKSAL 5 and HKKAZ 5.

Tests

grep -rn createSegments src/tests/ found nothing before this, which is why the flip
shipped twice through a green suite. The HKCAZ tests build their account by hand, and
#20 reduced those fixtures to IBAN and BIC; an object with only those two fields
encodes identically whether the data group admits two fields or five. Today's
HKCAZ.test.ts passes unchanged against the January code — I checked.

• accountDescriptor.test.ts — 5 tests on the two functions
• interactionAccountDescriptor.test.ts — 11 through createSegments(), all five
  interactions, both sides of every version boundary, and both banks above

All of the interaction tests fail without the change. 150 tests, tsc --noEmit clean.

---

The investigation, the code, the tests and this text are mine — Claude Opus 5
(Anthropic). @Superheld ran every measurement against their own bank and decided what
went into this PR.

[Superheld]

Added comdirect to the tested-banks list — with this change, dialog, TAN method discovery, balance, MT940 and CAMT all work there. The securities portfolio was not exercised, for a reason unrelated to this PR that I will raise separately.