Sign-in by customer: realm petrolyst, row rules, guest role (PD-21)

Keycloak import for realm petrolyst: two clients, petrolyst with MFA for
Superset and Traefik, petrolyst-app password only. It lists only
app.petrolyst.com and traefik.petrolyst.com, and no customer names, as this
repository is public. public.v_operator shows each customer's group. Dashboards
overview and site, role Petrolyst Guest, filtered by row. Superset refuses a
user with no mapped role. The realm travels with the release: each release's
compose files name their realm and secret file, and a rollback needs only its
target's secret. Not deployed.

Checks earlier on this content: tests/run.sh 109 of 109 and read-only, dashboards
import twice, column drift 0, compose config on old and new trees, the secret
check on a scratch folder, a rehearsal on a throwaway Keycloak 26.4. Never a real
deploy or rollback; shellcheck not installed today, clean when last run. Codex
inspected once; its fixes are not re-inspected, on the owner's word.

Bands: persistence, Superset. Rules: 1, 2, 3, 6, 14.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

host/secrets-init.sh

@@ -2,7 +2,8 @@
 # Server secrets, run as root after bootstrap.sh.
 #   secrets-init.sh                  generate every missing secret; never overwrites one
 #   secrets-init.sh keycloak-secret  store the client secret of Keycloak client
-#                                    "petrolyst" (Clients > petrolyst > Credentials),
+#                                    "petrolyst" of realm "petrolyst"
+#                                    (Clients > petrolyst > Credentials),
 #                                    read from the terminal or stdin
 #
 # Layout: /opt/petrolyst/secrets/{shared,traefik,fuel-monitoring}/ are root:deploy
@@ -50,8 +51,8 @@ case ${1:-all} in
     fi
     value=$(printf '%s' "$value" | tr -d '[:space:]')
     [ -n "$value" ] || die "empty secret"
-    write_secret "$SECRETS/shared/keycloak_petrolyst_client_secret" "$value"
-    echo "stored    $SECRETS/shared/keycloak_petrolyst_client_secret"
+    write_secret "$SECRETS/shared/keycloak_petrolyst_realm_client_secret" "$value"
+    echo "stored    $SECRETS/shared/keycloak_petrolyst_realm_client_secret"
     exit 0
     ;;
   all) ;;
@@ -66,10 +67,10 @@ generate "$SECRETS/fuel-monitoring/fuel_db_ro_password" 32
 # 32 hex characters = a 32-byte cookie key, as oauth2-proxy requires.
 generate "$SECRETS/traefik/oauth2_proxy_cookie_secret" 16
 
-if [ ! -s "$SECRETS/shared/keycloak_petrolyst_client_secret" ]; then
+if [ ! -s "$SECRETS/shared/keycloak_petrolyst_realm_client_secret" ]; then
   echo
   echo "Still missing: the Keycloak client secret. Copy it from Keycloak"
-  echo "(realm thedigitalbridge > Clients > petrolyst > Credentials), then run:"
+  echo "(realm petrolyst > Clients > petrolyst > Credentials), then run:"
   echo "  $0 keycloak-secret"
   exit 1
 fi