fix(k8s): declare every theme type in big-demo so the account console loads (refs #177)

KC_SPI_THEME_DEFAULT applies to all theme types and Keycloak does not fall back
for one the theme lacks: the account console returned 500 (NPE on a null
theme). The theme is now one ConfigMap mounted as a directory with login,
account, admin and email types; the podspec gains `items` for that.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

infra/helm/big-reference/templates/_helpers.tpl

@@ -94,6 +94,10 @@ volumes:
       {{- with .defaultMode }}
       defaultMode: {{ . }}
       {{- end }}
+      {{- with .items }}
+      items:
+{{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}
 {{- with $w.data }}
   - name: data

infra/helm/big-reference/templates/deployments.yaml

@@ -30,8 +30,8 @@ spec:
       annotations:
         checksum/portal-config: {{ include "big.keycloakUrl" $ | sha256sum }}
       {{- end }}
-      {{- /* subPath mounts never refresh, so Keycloak restarts when the toggle flips. */}}
-      {{- if eq .configMap "kc-theme-js" }}
+      {{- /* Keycloak reads the theme at startup, so it restarts when the toggle flips. */}}
+      {{- if eq .configMap "kc-theme" }}
       annotations:
         checksum/otp-autofill: {{ $.Values.demo.otpAutofill | toString | sha256sum }}
       {{- end }}

infra/helm/big-reference/templates/keycloak-theme.yaml

@@ -1,9 +1,13 @@
 {{- /*
-Keycloak login theme `big-demo`: keycloak.v2 plus one script. It is always
+Keycloak theme `big-demo`: keycloak.v2 plus one login script. It is always
 mounted and always the default theme (KC_SPI_THEME_DEFAULT), so the only thing
 `demo.otpAutofill` switches is what that script does. Off, it is empty and the
 login is exactly keycloak.v2.
 
+KC_SPI_THEME_DEFAULT covers every theme type, and Keycloak does not fall back
+for a type the theme lacks (the account console 500s), so account, admin and
+email are declared too, each a plain child of Keycloak 26's own default.
+
 On, the medewerker OTP step computes the code from the realm fixture secret
 (docs/runbooks/keycloak.md) and submits it: the demo still shows MFA being
 enforced without anyone needing an authenticator. The secret is committed and
@@ -17,18 +21,16 @@ metadata:
   labels:
 {{- include "big.labels" (dict "root" $ "name" "kc-theme") | nindent 4 }}
 data:
-  theme.properties: |
+  login.properties: |
     parent=keycloak.v2
     import=common/keycloak
     scripts=js/otp-autofill.js
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kc-theme-js
-  labels:
-{{- include "big.labels" (dict "root" $ "name" "kc-theme-js") | nindent 4 }}
-data:
+  account.properties: |
+    parent=keycloak.v3
+  admin.properties: |
+    parent=keycloak.v2
+  email.properties: |
+    parent=keycloak
   otp-autofill.js: |
 {{- if .Values.demo.otpAutofill }}
     // RFC 6238 with Keycloak's default policy (HmacSHA1, 6 digits, 30 s) over the