feat(k8s): optionally auto-fill the medewerker OTP step for the public demo (refs #177)

A `big-demo` Keycloak login theme (keycloak.v2 + one script) is always mounted
and set as default. With demo.otpAutofill (repo variable OTP_AUTOFILL=true) the
script computes the code from the committed fixture secret and submits it, so
the demo shows MFA enforced without an authenticator. Off by default: the
script is empty and the login is plain keycloak.v2.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/runbooks/kubernetes-talos.md

@@ -430,6 +430,11 @@ make k8s-up TALOS_HOST=localhost K8S_REGISTRY=<TALOS_HOST>:30500 \
 For deploy-on-merge, set the repository variable `KEYCLOAK_URL` to the same value.
 With it set, the `localhost` port-forwards (§5) no longer log in: the issuer is one string.
 
+Staff logins still hit the enforced OTP step. For a demo, set the repository variable
+`OTP_AUTOFILL=true` (chart value `demo.otpAutofill`): the `big-demo` login theme then
+fills in and submits the code from the fixture secret, so the step is visible but needs no
+authenticator. Keycloak restarts when the value flips. Demo only — the secret is committed.
+
 One-time setup:
 
 1. Fedora host: install `infra/development/big-portals-tunnel.service` from the Infra repo