KC_SPI_THEME_DEFAULT applies to all theme types and Keycloak does not fall back
for one the theme lacks: the account console returned 500 (NPE on a null
theme). The theme is now one ConfigMap mounted as a directory with login,
account, admin and email types; the podspec gains `items` for that.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A `big-demo` Keycloak login theme (keycloak.v2 + one script) is always mounted
and set as default. With demo.otpAutofill (repo variable OTP_AUTOFILL=true) the
script computes the code from the committed fixture secret and submits it, so
the demo shows MFA enforced without an authenticator. Off by default: the
script is empty and the login is plain keycloak.v2.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>