test: --demo's disabled smtp-password, with its note, is in kv-app-prod

internal/provider/fake/fake.go

@@ -303,6 +303,10 @@ func Azure(delay time.Duration) *Provider {
 		Name: "legacy-token", Version: "0c11de", Enabled: &yes, Updated: base.AddDate(-1, 0, 0),
 		Expires: base.AddDate(0, -3, 0), Reference: secretRef("kv-app-prod", "legacy-token"),
 	}, "deprecated")
+	p.add(kv, provider.TypeSecret, provider.Object{
+		Name: "smtp-password", Version: "7d2e90", Enabled: &no, Updated: base.AddDate(0, -2, 0),
+		Reference: secretRef("kv-app-prod", "smtp-password"),
+	}, "smtp-demo-password")
 
 	p.add(kv, provider.TypeKey, provider.Object{
 		Name: "signing-key", Version: "5e21b7", Enabled: &yes, Updated: base.AddDate(0, -3, 0),
@@ -350,7 +354,7 @@ func Azure(delay time.Duration) *Provider {
 		Name: "env-share", Enabled: &yes, Updated: base, Reference: secretRef("kv-shared-prod", "env-share"),
 	}, "q8Zt3VwL1mXc7Rk2Pj9Ys4Hn6Bf0Ga5Ud+Te/OiWlE=")
 	p.add(shared, provider.TypeSecret, provider.Object{
-		Name: "smtp-password", Enabled: &no, Updated: base, Reference: secretRef("kv-shared-prod", "smtp-password"),
+		Name: "smtp-password", Enabled: &yes, Updated: base, Reference: secretRef("kv-shared-prod", "smtp-password"),
 	}, "smtp-demo-password")
 	p.fail(shared, ErrForbiddenKeys, provider.TypeKey)
 
@@ -397,7 +401,7 @@ func AzureOps(delay time.Duration) *Provider {
 	}, "break-glass-demo-password")
 	shared := p.addContainer(prod, "kv-shared-prod", "https://kv-shared-prod.vault.azure.net", allTypes...)
 	p.add(shared, provider.TypeSecret, provider.Object{
-		Name: "smtp-password", Enabled: &no, Updated: base, Reference: secretRef("kv-shared-prod", "smtp-password"),
+		Name: "smtp-password", Enabled: &yes, Updated: base, Reference: secretRef("kv-shared-prod", "smtp-password"),
 	}, "smtp-demo-password")
 	// Unlike the first account, ops may read keys here.
 	p.add(shared, provider.TypeKey, provider.Object{