feat(k8s): optionally auto-fill the medewerker OTP step for the public demo (refs #177)

A `big-demo` Keycloak login theme (keycloak.v2 + one script) is always mounted
and set as default. With demo.otpAutofill (repo variable OTP_AUTOFILL=true) the
script computes the code from the committed fixture secret and submits it, so
the demo shows MFA enforced without an authenticator. Off by default: the
script is empty and the login is plain keycloak.v2.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy.yaml

@@ -31,6 +31,9 @@ jobs:
       # origin, e.g. https://big-auth.labs.respellion.tech (runbook, "Publishing
       # through the labs Caddy").
       KEYCLOAK_URL: ${{ vars.KEYCLOAK_URL }}
+      # `true` fills in the medewerker OTP step for the public demo (chart value
+      # demo.otpAutofill). The fixture secret is committed: demo only.
+      OTP_AUTOFILL: ${{ vars.OTP_AUTOFILL }}
     steps:
       - uses: https://github.com/actions/checkout@v4
 
@@ -97,7 +100,7 @@ jobs:
           make k8s-reseed \
             TALOS_HOST=${TALOS_HOST:-localhost} \
             K8S_REGISTRY=${TALOS_VM_IP:-192.168.122.173}:30500 \
-            K8S_SET="${KEYCLOAK_URL:+--set keycloakUrl=$KEYCLOAK_URL}"
+            K8S_SET="${KEYCLOAK_URL:+--set keycloakUrl=$KEYCLOAK_URL} --set demo.otpAutofill=${OTP_AUTOFILL:-false}"
 
       # `dev` is a mutable tag and helm sees an unchanged pod template, so the
       # new images only land on a restart (pullPolicy is already Always).