Feature request: expose Application context (icon, slug, name) on flow executor for per-app branding

## Feature request

### Use case

When an application uses Authentik for OIDC authentication, the application context (slug, meta_icon, meta_launch_url, meta_description) is currently **not exposed** on the flow executor page (`/if/flow/...`). This makes it impossible to brand the login page per-application using custom CSS only.

The current `ak-stage-identification` natively shows "Login to continue to " in the subtitle, which is great. But the visible logo on the login page is the **Brand** logo (a single logo for the whole IDP instance), not the application's logo.

This is a common pattern in commercial IDPs (Auth0 Universal Login, Okta sign-in widget, Keycloak themes) where you can show the **application's logo** to the user during authentication to reinforce "I'm logging in to App X".

### Proposed solution (any of)

1. **Expose `application.meta_icon` as CSS variable** on the flow executor host element:
```css
ak-flow-executor {
--ak-application-icon-url: url('...');
--ak-application-name: 'Laserbox';
--ak-application-slug: 'laserbox';
}
```
Custom CSS could then use `--ak-application-icon-url` as `background-image` on a custom element.

2. **Expose `application.meta_icon_url` as `data-*` attribute** on `` or `ak-flow-executor`:
```html

```
Allows `[data-application-slug="laserbox"] .branding-logo { background: url(...) }`.

3. **Add a dedicated CSS `::part` for application icon** in `ak-stage-identification`:
```css
ak-stage-identification::part(application-icon) { ... }
```
Where Authentik renders an `` slot conditionally if `context.application.meta_icon` is set.

### Workarounds considered

- ❌ Expression Policy + Redirect Stage Static (custom Python, fragile, breaks "natif robuste" principle)
- ❌ Custom HTML template override (not supported beyond email templates per official docs)
- ❌ Fork Authentik image (drift, maintenance burden)

### Context

We use Authentik 2026.2.x as primary IDP for ~5 internal apps. Per-app branding on the login page would significantly improve UX (users currently land on a generic Authentik page after RP-initiated logout and can be confused about what app they're authenticating to, even with the i18n subtitle).

Related issues: #10430, #19201 (post_logout_redirect_uri non-support — out of scope here but related to the broader UX of per-app login pages after logout).