Sign-in by customer: realm petrolyst, row rules, guest role (PD-21)

Keycloak import for realm petrolyst: two clients, petrolyst with MFA for
Superset and Traefik, petrolyst-app password only. It lists only
app.petrolyst.com and traefik.petrolyst.com, and no customer names, as this
repository is public. public.v_operator shows each customer's group. Dashboards
overview and site, role Petrolyst Guest, filtered by row. Superset refuses a
user with no mapped role. The realm travels with the release: each release's
compose files name their realm and secret file, and a rollback needs only its
target's secret. Not deployed.

Checks earlier on this content: tests/run.sh 109 of 109 and read-only, dashboards
import twice, column drift 0, compose config on old and new trees, the secret
check on a scratch folder, a rehearsal on a throwaway Keycloak 26.4. Never a real
deploy or rollback; shellcheck not installed today, clean when last run. Codex
inspected once; its fixes are not re-inspected, on the owner's word.

Bands: persistence, Superset. Rules: 1, 2, 3, 6, 14.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

stacks/fuel-monitoring/fuel-db/tests/read_only.sql

@@ -7,15 +7,15 @@ BEGIN
   FOREACH v IN ARRAY ARRAY['v_site','v_kpi_measures','v_hour_meter_evidence','v_assumption','v_baseline_version',
                            'v_baseline_input','v_evidence','v_delivery','v_stock_reading','v_interval','v_runtime',
                            'v_coverage','v_reconciliation','v_data_quality','v_spec_reference','v_modelled_lph',
-                           'v_electricity_cost','v_imported_calculation'] LOOP
+                           'v_electricity_cost','v_imported_calculation','v_operator'] LOOP
     EXECUTE format('SELECT count(*) FROM public.%I', v);
     SELECT EXISTS (SELECT 1 FROM information_schema.columns c
                    WHERE c.table_schema = 'public' AND c.table_name = v AND c.column_name = 'operator_uid') INTO has;
     IF NOT has THEN RAISE EXCEPTION '% has no operator_uid', v; END IF;
     n := n + 1;
   END LOOP;
-  IF n <> 18 THEN RAISE EXCEPTION 'expected 18 views, checked %', n; END IF;
-  IF (SELECT count(*) FROM information_schema.views WHERE table_schema = 'public' AND table_name LIKE 'v\_%') <> 18 THEN
+  IF n <> 19 THEN RAISE EXCEPTION 'expected 19 views, checked %', n; END IF;
+  IF (SELECT count(*) FROM information_schema.views WHERE table_schema = 'public' AND table_name LIKE 'v\_%') <> 19 THEN
     RAISE EXCEPTION 'public holds a view this list does not name';
   END IF;
 
@@ -32,5 +32,5 @@ BEGIN
     RAISE EXCEPTION USING ERRCODE = 'TT001', MESSAGE = 'fuel_ro created a table';
   EXCEPTION WHEN insufficient_privilege OR read_only_sql_transaction THEN NULL;
   END;
-  RAISE NOTICE 'read-only role: 18 views readable, each with operator_uid; fm and licence refused; writes refused';
+  RAISE NOTICE 'read-only role: 19 views readable, each with operator_uid; fm and licence refused; writes refused';
 END $$;