refactor(k8s): keep the big-demo theme as real files under infra/keycloak/themes (refs #177)

The theme was inline text in a Helm template. It now lives next to the realms
and is seeded as rr-kc-theme by seed-configmaps.sh, like every other file
input, so it can be edited as a normal Keycloak theme. demo.otpAutofill now
only decides whether KC_SPI_THEME_DEFAULT is set (big.env skips values that
render empty); off, Keycloak keeps its stock theme.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

infra/helm/big-reference/values.yaml

@@ -32,8 +32,8 @@ keycloakUrl: ""
 
 demo:
   # Fill in and submit the medewerker OTP step from the fixture secret, so a public
-  # demo shows MFA enforced without an authenticator (templates/keycloak-theme.yaml).
-  # Demo only: the secret is committed.
+  # demo shows MFA enforced without an authenticator: makes the big-demo theme
+  # (infra/keycloak/themes/big-demo) Keycloak's default. Demo only: the secret is committed.
   otpAutofill: false
 
 # Set when pulling from a private registry (e.g. the Gitea Container Registry).
@@ -281,15 +281,17 @@ workloads:
       # this issuer back, which is what browser tokens carry (infra/host-browser.yml).
       KC_HOSTNAME: '{{ include "big.keycloakUrl" . }}'
       KC_HOSTNAME_BACKCHANNEL_DYNAMIC: "true"
-      # keycloak.v2 plus the demo.otpAutofill script (templates/keycloak-theme.yaml).
-      KC_SPI_THEME_DEFAULT: big-demo
+      # Only rendered with demo.otpAutofill (big.env skips empty values); off, Keycloak
+      # keeps its stock theme and the mounted big-demo theme is unused.
+      KC_SPI_THEME_DEFAULT: '{{ if .Values.demo.otpAutofill }}big-demo{{ end }}'
     ports: [{ name: http, port: 8080 }]
     # TCP, not /health/ready on the management port: nothing here gates on realm
     # import, and a wrong health path would leave the Service with no endpoints.
     probe: { tcpSocket: { port: 8080 }, initialDelaySeconds: 15 }
     files:
       - { configMap: rr-kc-realms, mountPath: /opt/keycloak/data/import }
-      - configMap: kc-theme
+      # infra/keycloak/themes/big-demo, seeded by infra/helm/seed-configmaps.sh.
+      - configMap: rr-kc-theme
         mountPath: /opt/keycloak/themes/big-demo
         items:
           - { key: login.properties, path: login/theme.properties }