Trial state of 29 Oct 2026: ATOMA reader setup, app dashboards, embedding notes

Baseline before the clean-up (PD-13): the PD-11 reader setup and the PD-12 app
dashboards as they ran on the local stack, uncommitted until now. Not deployed,
not independently reviewed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

petrolyst-insights/petrolyst_security.py

@@ -11,6 +11,9 @@ the stock behaviour:
   login page on /login/, which only shows a "Sign in with keycloak" button.
 - /logout/ also ends the Keycloak session, so the next visit asks for the
   password and OTP again.
+
+It also takes the reader rules (petrolyst_reader.ReaderAccessMixin), as does the
+local stack's database-login manager.
 """
 
 import logging
@@ -24,6 +27,7 @@ from flask_appbuilder.utils.base import get_safe_redirect
 from flask_login import logout_user
 from werkzeug.wrappers import Response as WerkzeugResponse
 
+from petrolyst_reader import ReaderAccessMixin
 from superset.security import SupersetSecurityManager
 
 logger = logging.getLogger(__name__)
@@ -64,7 +68,7 @@ class PetrolystAuthOAuthView(AuthOAuthView):
         return redirect(f"{end_session}?{urlencode(params)}")
 
 
-class PetrolystSecurityManager(SupersetSecurityManager):
+class PetrolystSecurityManager(ReaderAccessMixin, SupersetSecurityManager):
     authoauthview = PetrolystAuthOAuthView
     # Without this, Superset registers its React login page on /login/ before
     # FAB's OAuth view, and that page wins the route.