feat(k8s): optionally auto-fill the medewerker OTP step for the public demo (refs #177)

A `big-demo` Keycloak login theme (keycloak.v2 + one script) is always mounted
and set as default. With demo.otpAutofill (repo variable OTP_AUTOFILL=true) the
script computes the code from the committed fixture secret and submits it, so
the demo shows MFA enforced without an authenticator. Off by default: the
script is empty and the login is plain keycloak.v2.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

infra/helm/big-reference/templates/deployments.yaml

@@ -30,6 +30,11 @@ spec:
       annotations:
         checksum/portal-config: {{ include "big.keycloakUrl" $ | sha256sum }}
       {{- end }}
+      {{- /* subPath mounts never refresh, so Keycloak restarts when the toggle flips. */}}
+      {{- if eq .configMap "kc-theme-js" }}
+      annotations:
+        checksum/otp-autofill: {{ $.Values.demo.otpAutofill | toString | sha256sum }}
+      {{- end }}
       {{- end }}
       labels:
 {{- include "big.labels" (dict "root" $ "name" $name) | nindent 8 }}

infra/helm/big-reference/templates/keycloak-theme.yaml

@@ -0,0 +1,60 @@
+{{- /*
+Keycloak login theme `big-demo`: keycloak.v2 plus one script. It is always
+mounted and always the default theme (KC_SPI_THEME_DEFAULT), so the only thing
+`demo.otpAutofill` switches is what that script does. Off, it is empty and the
+login is exactly keycloak.v2.
+
+On, the medewerker OTP step computes the code from the realm fixture secret
+(docs/runbooks/keycloak.md) and submits it: the demo still shows MFA being
+enforced without anyone needing an authenticator. The secret is committed and
+shared, so this is a demo convenience only — never enable it anywhere real.
+*/ -}}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kc-theme
+  labels:
+{{- include "big.labels" (dict "root" $ "name" "kc-theme") | nindent 4 }}
+data:
+  theme.properties: |
+    parent=keycloak.v2
+    import=common/keycloak
+    scripts=js/otp-autofill.js
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kc-theme-js
+  labels:
+{{- include "big.labels" (dict "root" $ "name" "kc-theme-js") | nindent 4 }}
+data:
+  otp-autofill.js: |
+{{- if .Values.demo.otpAutofill }}
+    // RFC 6238 with Keycloak's default policy (HmacSHA1, 6 digits, 30 s) over the
+    // raw bytes of the medewerker fixture secret — same as tests/e2e/keycloak-login.ts.
+    document.addEventListener('DOMContentLoaded', async () => {
+      const input = document.querySelector('input[name="otp"]');
+      if (!input || !input.form) return;
+      const key = await crypto.subtle.importKey('raw',
+        new TextEncoder().encode('BIGMEDEWERKEROTPSEED'), { name: 'HMAC', hash: 'SHA-1' }, false, ['sign']);
+      // A code is single-use, so a second login in the same window spends the next
+      // counter (Keycloak's look-ahead accepts it). Past that, fill but don't submit,
+      // so a rejected code can't turn into a submit loop.
+      const now = Math.floor(Date.now() / 30000);
+      let last = -1;
+      try { last = Number(sessionStorage.getItem('big-otp-counter')) || -1; } catch {}
+      const counter = Math.max(now, last + 1);
+      const msg = new DataView(new ArrayBuffer(8));
+      msg.setBigUint64(0, BigInt(counter));
+      const mac = new Uint8Array(await crypto.subtle.sign('HMAC', key, msg.buffer));
+      const o = mac[19] & 0x0f;
+      const n = ((mac[o] & 0x7f) << 24 | mac[o + 1] << 16 | mac[o + 2] << 8 | mac[o + 3]) % 1e6;
+      input.value = String(n).padStart(6, '0');
+      if (counter > now + 1) return;
+      try { sessionStorage.setItem('big-otp-counter', String(counter)); } catch {}
+      input.form.requestSubmit();
+    });
+{{- else }}
+    // demo.otpAutofill is off: the OTP step is entered by hand.
+{{- end }}