iOS clients send every flow-executor request twice - causes lockout

### Describe the bug

On iOS (Safari, PWAs, ASWebAuthenticationSession), every request the flow executor makes reaches the server twice, starting 1-2 ms apart, POSTs and GETs both. The duplication happens in Apple's network stack, below the page: Safari-side inspection shows a single request. Desktop browsers are unaffected.

### Other issues

[#12446](https://github.com/goauthentik/authentik/issues/12446), [#9934](https://github.com/goauthentik/authentik/issues/9934), [#5972](https://github.com/goauthentik/authentik/issues/5972).
The OS-level duplication is documented in WebKit bugs [199183](https://bugs.webkit.org/show_bug.cgi?id=199183) and [199492](https://bugs.webkit.org/show_bug.cgi?id=199492), and in [Apple Communities thread 255536544](https://discussions.apple.com/thread/255536544).

### How to reproduce

1. authentik with a TOTP validation stage in the authentication flow.
2. Log in from an iPhone with TOTP enrolled.
3. Access logs show each stage submission as two POSTs, every successful login has another one with `login_failed`.

```
07:29:16.516 POST /api/v3/flows/executor/default-authentication-flow/ 302 (41ms)
07:29:16.518 POST /api/v3/flows/executor/default-authentication-flow/ 302 (41ms)
07:29:24.517 POST ... 302 (130ms) <- TOTP stage: winner
07:29:24.557 POST ... 200 (169ms) <- TOTP stage: loser, replay-rejected
```

### Expected behavior

A duplicated identical submission should not consume a second one-time credential, emit `login_failed`, or lock the user out.

### Screenshots

_No response_

### Additional context

iOS Client: iPhone OS 18_7, WebKit Version/26.6

### Deployment Method

Docker

### Version

2026.5.6 & 2026.8.0

### Relevant log output

```shell
07:29:16.516 POST /api/v3/flows/executor/default-authentication-flow/ 302 (41ms)
07:29:16.518 POST /api/v3/flows/executor/default-authentication-flow/ 302 (41ms)
07:29:24.517 POST ... 302 (130ms) <- TOTP stage: winner
07:29:24.557 POST ... 200 (169ms) <- TOTP stage: loser, replay-rejected
```