Merge branch 'main' into feat/demo-otp-autofill

The theme was inline text in a Helm template. It now lives next to the realms
and is seeded as rr-kc-theme by seed-configmaps.sh, like every other file
input, so it can be edited as a normal Keycloak theme. demo.otpAutofill now
only decides whether KC_SPI_THEME_DEFAULT is set (big.env skips values that
render empty); off, Keycloak keeps its stock theme.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

infra/helm/big-reference/values.yaml

@@ -286,11 +286,6 @@ workloads:
       # Only rendered with demo.otpAutofill (big.env skips empty values); off, Keycloak
       # keeps its stock theme and the mounted big-demo theme is unused.
       KC_SPI_THEME_DEFAULT: '{{ if .Values.demo.otpAutofill }}big-demo{{ end }}'
-      # Behind a TLS proxy (keycloakUrl) the dynamic backchannel URLs — token,
-      # userinfo, certs — take their scheme from the request, which reaches Keycloak
-      # as plain http; trusting X-Forwarded-Proto keeps them https so the browser
-      # doesn't block them as mixed content. In-cluster calls send no such header.
-      KC_PROXY_HEADERS: xforwarded
     ports: [{ name: http, port: 8080 }]
     # TCP, not /health/ready on the management port: nothing here gates on realm
     # import, and a wrong health path would leave the Service with no endpoints.