test(infra): medewerker login must be refused without a second factor (refs #132)

The keycloak smoke check now asserts that a password-only grant on the medewerker
realm is rejected and that a TOTP code completes it. The e2e medewerker logins move
to a shared helper that submits Keycloak's OTP challenge. Both fail against the
current realm export, which enforces no MFA.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/e2e/default-fill.spec.ts

@@ -1,4 +1,5 @@
 import { expect, test } from '@playwright/test';
+import { loginMedewerker } from './medewerker-login';
 
 // S-15b: a beheerder edits the ACL default-fill in the beheer portal and gets a saved confirmation.
 // Runs against the shared verify stack; it edits + saves (the ACL store is in-memory, ADR-0026) and
@@ -6,10 +7,8 @@ import { expect, test } from '@playwright/test';
 test('a beheerder edits and saves the default-fill', async ({ page }) => {
   await page.goto('http://beheer/');
 
-  // Keycloak medewerker-realm login (same realm as behandel).
-  await page.locator('#username').fill('bram-beheerder');
-  await page.locator('#password').fill('test123');
-  await page.locator('#kc-login').click();
+  // Keycloak medewerker-realm login (same realm as behandel) — password + enforced TOTP.
+  await loginMedewerker(page, 'bram-beheerder');
 
   await expect(page.getByRole('heading', { name: /Catalogus/i })).toBeVisible();