[6.x] Fix login redirects

[jasonvarga]

Summary

When an unauthenticated user visits a protected URL, they're redirected to the login page. After logging in, they should land back on the URL they originally tried to reach — but they were being sent to the home page (CP or site) instead.

This affected every login method on both the CP and the frontend: regular password login, passkey login, two-factor challenge (TOTP and recovery code), and the two-factor setup flow.

Changes

CP

• AuthenticationException now redirects via redirect()->guest(...), which stores the originally requested URL in the session as url.intended.
• LoginController::authenticated() already called redirect()->intended(...), which now has a target to recall.
• Removed dead referer query plumbing (getReferrer(), the referer Inertia prop, and the conditional in redirectPath()). The Inertia login form never POSTed a referer field, so the server-side check was always null.
• Login.vue now hard-reloads to page.url (the URL Inertia ended up at after following the server's redirect) instead of the unused props.referer. The full page load is preserved so the destination CP page boots with all its initial props. The two-factor challenge early return in onSuccess is preserved so that flow stays an Inertia transition.
• The passkey and two-factor challenge controllers now also honor url.intended (previously they used a referer form input that the JS never sent for passkey, and a hand-rolled session key for 2FA).

Frontend

• User/LoginController, User/PasskeyLoginController, TwoFactorChallengeController, TwoFactorSetupController, and User/TwoFactorAuthenticationController all route through url.intended instead of the short-lived login.redirect session key introduced last week.
• The auth middleware already redirects via redirect()->guest(...), so frontend forms without an explicit _redirect input now land on the originally requested URL after login.
• Explicit _redirect form inputs still win — they're written into url.intended so they survive multi-step flows (e.g. login → 2FA challenge, login → 2FA setup).

Internal

• The parallel login.redirect session key has been removed entirely. Everything now uses Laravel's standard url.intended, accessed via redirect()->setIntendedUrl(), redirect()->getIntendedUrl(), and redirect()->intended().
• login.redirect was only introduced last week (unreleased), so removing it is not a compatibility break.
• CP subclasses now override only the default fallback URL via small defaultRedirectPath() / defaultRedirectUrl() hooks, instead of duplicating the whole resolution logic.