Constrain PostHog consent to one normal category per banner

Add a partial unique index ensuring only one category per banner can
have posthog_consent enabled. Default it to the analytics category on
banner creation, clear the previous mapping before setting a new one,
and restrict the toggle to NORMAL categories in both the service layer
and the console UI.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/server/api/console/v1/cookie_banner_resolvers.go

@@ -482,6 +482,9 @@ func (r *mutationResolver) UpdateCookieCategory(ctx context.Context, input types
 		if errors.Is(err, cookiebanner.ErrCategorySlugAlreadyExists) {
 			return nil, gqlutils.Conflict(ctx, err)
 		}
+		if errors.Is(err, cookiebanner.ErrPostHogConsentKindInvalid) {
+			return nil, gqlutils.Invalid(ctx, err)
+		}
 		if validationErrors, ok := errors.AsType[validator.ValidationErrors](err); ok {
 			return nil, gqlutils.InvalidValidationErrors(ctx, validationErrors)
 		}