Sign-in by customer: realm petrolyst, row rules, guest role (PD-21)

Keycloak import for realm petrolyst: two clients, petrolyst with MFA for
Superset and Traefik, petrolyst-app password only. It lists only
app.petrolyst.com and traefik.petrolyst.com, and no customer names, as this
repository is public. public.v_operator shows each customer's group. Dashboards
overview and site, role Petrolyst Guest, filtered by row. Superset refuses a
user with no mapped role. The realm travels with the release: each release's
compose files name their realm and secret file, and a rollback needs only its
target's secret. Not deployed.

Checks earlier on this content: tests/run.sh 109 of 109 and read-only, dashboards
import twice, column drift 0, compose config on old and new trees, the secret
check on a scratch folder, a rehearsal on a throwaway Keycloak 26.4. Never a real
deploy or rollback; shellcheck not installed today, clean when last run. Codex
inspected once; its fixes are not re-inspected, on the owner's word.

Bands: persistence, Superset. Rules: 1, 2, 3, 6, 14.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

AGENTS.md

@@ -12,7 +12,7 @@ keep the rules there; a change against a rule or an open conflict goes to the ow
 - `stacks/`, `traefik/`, `deploy/`, `host/`: how and where things run.
 - `petrolyst-insights/`: what Superset looks like and does (config, security manager, the guest
   role, branding, patches, dashboards as code). Its README maps each file to the image.
-- `keycloak/`: the `petrolyst` client import.
+- `keycloak/`: the import of realm `petrolyst`'s two clients (`petrolyst`, `petrolyst-app`).
 
 ## Rules
 - **Commit messages** end their body with the bands and rules touched, for example
@@ -26,7 +26,8 @@ keep the rules there; a change against a rule or an open conflict goes to the ow
   export. `import_bundle.py` never deletes; old objects go by hand (`dashboards/README.md`).
 - **Embedding** stays off in production (`superset_config.py`) until PD-12's points are decided;
   the local stack turns it on in its own override.
-- **ATOMA's users** have no Superset role (PD-13): `atoma-reader` opens the Petrolyst app only.
+- **Customers' users** have no Superset account (PD-13, PD-21): role `reader` of client `petrolyst-app`
+  opens the Petrolyst app only, for the customer of their Keycloak group; Superset refuses them.
 - fuel-db migrations (`stacks/fuel-monitoring/fuel-db/migrations/`) are applied by hand (P3).
 
 ## Checks