feat(k8s): optionally auto-fill the medewerker OTP step for the public demo (refs #177)

A `big-demo` Keycloak login theme (keycloak.v2 + one script) is always mounted
and set as default. With demo.otpAutofill (repo variable OTP_AUTOFILL=true) the
script computes the code from the committed fixture secret and submits it, so
the demo shows MFA enforced without an authenticator. Off by default: the
script is empty and the login is plain keycloak.v2.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

infra/helm/big-reference/values.yaml

@@ -30,6 +30,12 @@ host: 192.168.122.100
 # portals' authority (runbook, "Publishing through the labs Caddy").
 keycloakUrl: ""
 
+demo:
+  # Fill in and submit the medewerker OTP step from the fixture secret, so a public
+  # demo shows MFA enforced without an authenticator (templates/keycloak-theme.yaml).
+  # Demo only: the secret is committed.
+  otpAutofill: false
+
 # Set when pulling from a private registry (e.g. the Gitea Container Registry).
 imagePullSecrets: []
 
@@ -275,11 +281,16 @@ workloads:
       # this issuer back, which is what browser tokens carry (infra/host-browser.yml).
       KC_HOSTNAME: '{{ include "big.keycloakUrl" . }}'
       KC_HOSTNAME_BACKCHANNEL_DYNAMIC: "true"
+      # keycloak.v2 plus the demo.otpAutofill script (templates/keycloak-theme.yaml).
+      KC_SPI_THEME_DEFAULT: big-demo
     ports: [{ name: http, port: 8080 }]
     # TCP, not /health/ready on the management port: nothing here gates on realm
     # import, and a wrong health path would leave the Service with no endpoints.
     probe: { tcpSocket: { port: 8080 }, initialDelaySeconds: 15 }
-    files: [{ configMap: rr-kc-realms, mountPath: /opt/keycloak/data/import }]
+    files:
+      - { configMap: rr-kc-realms, mountPath: /opt/keycloak/data/import }
+      - { configMap: kc-theme, mountPath: /opt/keycloak/themes/big-demo/login/theme.properties, subPath: theme.properties }
+      - { configMap: kc-theme-js, mountPath: /opt/keycloak/themes/big-demo/login/resources/js/otp-autofill.js, subPath: otp-autofill.js }
 
   # ── Flowable (S-03) ─────────────────────────────────────────────────────────
   flowable-db: