fix(login): preserve org domain suffix through account chooser navigation (#12304)

Closes #12024

# Which Problems Are Solved

When the login flow is started with an
`urn:zitadel:iam:org:domain:primary:{domain}` scope, the resolved domain
suffix is lost if the user navigates through the account chooser (e.g.
clicking "Use another account"). This causes the login to fail with
"User not found" because the organization can no longer be resolved.

Additionally, the `hideLoginNameSuffix` branding setting was never
respected by the login app.

# How the Problems Are Solved

- Forward the `orgDomain` parameter through `gotoAccounts()` and the
`/accounts` page, so it survives navigation to `/loginname` — the same
way `organization` and `requestId` are already forwarded.
- Respect `BrandingSettings.hideLoginNameSuffix`: when enabled, the
`@domain.com` suffix is hidden from the input UI but still used
internally for user search.

---------

Co-authored-by: Livio Spring <[email protected]>

apps/login/src/components/username-form.tsx

@@ -26,6 +26,7 @@ type Props = {
   organization?: string;
   defaultOrganization?: string;
   suffix?: string;
+  hideSuffix?: boolean;
   submit: boolean;
   allowRegister: boolean;
 };
@@ -36,6 +37,7 @@ export function UsernameForm({
   organization,
   defaultOrganization,
   suffix,
+  hideSuffix,
   loginSettings,
   submit,
   allowRegister,
@@ -111,7 +113,7 @@ export function UsernameForm({
             {...register("loginName", { required: t("required.loginName") })}
             label={inputLabel}
             data-testid="username-text-input"
-            suffix={suffix}
+            suffix={hideSuffix ? undefined : suffix}
           />
           {allowRegister && (
             <button