Preserve the next redirect across flow hops

## What

preserve the `next` redirect across flow hops (redirect stage, flow denial unwrap, and “Not you?”). Three surfaces, one user-visible bug.

## Want

- Preserve the `next` redirect across flow hops (redirect stage, flow denial unwrap,
- Three surfaces, one user-visible bug

## Ideas this came from

- [#17143 Option to include `next` URL parameter in redirect stages](https://github.com/goauthentik/authentik/issues/17143) — Problem: I want to use Authentik as a Oauth provider and I want to customize the UI. My approach to achieve this is to set up a flow with a single redirect stag
- [#17655 Flow executor does not respect "next" query parameter on flow denial due to query parameters being wrapped into "query"](https://github.com/goauthentik/authentik/issues/17655) — This is a continuation from #10333 The flow executor does not correctly unwrap the wrapped query parameters before handling the invalid flow in https://github.c
- [#25055 Clicking “Not you?” loses the pending next redirect](https://github.com/goauthentik/authentik/issues/25055) — When a user is already signed in to authentik but does not have access to an application, clicking “Not you?” and signing in as another user loses the original

Start by reading the three related issues (#17143, #17655, and #25055), then trace the redirect stage, flow-denial unwrap, and “Not you?” flow hops. Done means the pending `next` redirect survives each of those three surfaces without being lost.

Written by the indexing model from the issue text.