Sign-in by customer: realm petrolyst, row rules, guest role (PD-21)

Keycloak import for realm petrolyst: two clients, petrolyst with MFA for
Superset and Traefik, petrolyst-app password only. It lists only
app.petrolyst.com and traefik.petrolyst.com, and no customer names, as this
repository is public. public.v_operator shows each customer's group. Dashboards
overview and site, role Petrolyst Guest, filtered by row. Superset refuses a
user with no mapped role. The realm travels with the release: each release's
compose files name their realm and secret file, and a rollback needs only its
target's secret. Not deployed.

Checks earlier on this content: tests/run.sh 109 of 109 and read-only, dashboards
import twice, column drift 0, compose config on old and new trees, the secret
check on a scratch folder, a rehearsal on a throwaway Keycloak 26.4. Never a real
deploy or rollback; shellcheck not installed today, clean when last run. Codex
inspected once; its fixes are not re-inspected, on the owner's word.

Bands: persistence, Superset. Rules: 1, 2, 3, 6, 14.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

petrolyst-insights/roles/petrolyst_guest.py

@@ -1,14 +1,15 @@
-"""The role "ATOMA Guest": what the Petrolyst app's embedded dashboards may do (PD-12).
+"""The role "Petrolyst Guest": what the Petrolyst app's embedded dashboards may do (PD-12).
 
 Superset gives every embedded viewer (a guest pass signed for one dashboard) the role named by
-GUEST_ROLE_NAME. Which dashboard a guest sees comes from the pass, not from the role. Superset
+GUEST_ROLE_NAME. Which dashboard and which customer's rows a guest sees come from the pass, not from
+the role. Superset
 leaves the SQL out of chart-data responses for guests.
 
 Embedding is switched on in the local stack only (.local/fmdb-scratch, superset_config_local.py),
 so this script is not part of init.sh; run it by hand inside the Superset container, once, and
 again whenever PERMISSIONS change:
 
-    docker exec <superset> /app/.venv/bin/python /app/petrolyst-roles/atoma_guest.py
+    docker exec <superset> /app/.venv/bin/python /app/petrolyst-roles/petrolyst_guest.py
 
 Creates the role if needed and gives it exactly PERMISSIONS: missing ones are added, any other
 is removed (also one added by hand in the UI). A second run changes nothing.
@@ -22,7 +23,7 @@ from __future__ import annotations
 
 import sys
 
-ROLE = "ATOMA Guest"
+ROLE = "Petrolyst Guest"
 PERMISSIONS = [
     ("can_read", "Dashboard"),  # the dashboard and its charts' definitions
     ("can_dashboard", "Superset"),  # the dashboard page