feat(k8s): optionally auto-fill the medewerker OTP step for the public demo (refs #177)

A `big-demo` Keycloak login theme (keycloak.v2 + one script) is always mounted
and set as default. With demo.otpAutofill (repo variable OTP_AUTOFILL=true) the
script computes the code from the committed fixture secret and submits it, so
the demo shows MFA enforced without an authenticator. Off by default: the
script is empty and the login is plain keycloak.v2.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

infra/helm/big-reference/templates/deployments.yaml

@@ -30,6 +30,11 @@ spec:
       annotations:
         checksum/portal-config: {{ include "big.keycloakUrl" $ | sha256sum }}
       {{- end }}
+      {{- /* subPath mounts never refresh, so Keycloak restarts when the toggle flips. */}}
+      {{- if eq .configMap "kc-theme-js" }}
+      annotations:
+        checksum/otp-autofill: {{ $.Values.demo.otpAutofill | toString | sha256sum }}
+      {{- end }}
       {{- end }}
       labels:
 {{- include "big.labels" (dict "root" $ "name" $name) | nindent 8 }}