Remove Trino: Superset reads fuel-db directly as fuel_ro (PD-14)

trino/ deleted; the role trino_ro becomes fuel_ro, its password read from a
secret file at connect time; dashboards' SQL and column list for PostgreSQL;
the Compose project is renamed petrolyst, with volumes pinned to their old
names. AGENTS.md points to the architecture context. Not deployed: the next
deploy needs README's one-time steps first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

host/bootstrap.sh

@@ -40,7 +40,7 @@ if [ "$(cat /etc/docker/daemon.json 2>/dev/null)" != "$daemon_json" ]; then
 fi
 systemctl enable --now docker
 
-echo "== swap (4 GB) for Trino, Superset and two Postgres in 7.8 GB"
+echo "== swap (4 GB) for Superset and two Postgres in 7.8 GB"
 if ! swapon --show=NAME --noheadings | grep -qx /swapfile; then
   [ -e /swapfile ] || fallocate -l 4G /swapfile
   chmod 600 /swapfile

host/secrets-init.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Server secrets and env files, run as root after bootstrap.sh.
+# Server secrets, run as root after bootstrap.sh.
 #   secrets-init.sh                  generate every missing secret; never overwrites one
 #   secrets-init.sh keycloak-secret  store the client secret of Keycloak client
 #                                    "petrolyst" (Clients > petrolyst > Credentials),
@@ -17,7 +17,7 @@ getent group deploy >/dev/null || die "group deploy is missing: run host/bootstr
 ROOT=/opt/petrolyst
 SECRETS=$ROOT/secrets
 umask 077
-install -d -o root -g deploy -m 0750 "$SECRETS" "$SECRETS/shared" "$SECRETS/traefik" "$SECRETS/fuel-monitoring" "$ROOT/env"
+install -d -o root -g deploy -m 0750 "$SECRETS" "$SECRETS/shared" "$SECRETS/traefik" "$SECRETS/fuel-monitoring"
 
 # write_secret <path> <value>: no trailing newline (oauth2-proxy reads the file
 # byte for byte), replaced atomically.
@@ -62,22 +62,10 @@ esac
 generate "$SECRETS/fuel-monitoring/superset_secret_key" 32
 generate "$SECRETS/fuel-monitoring/superset_db_password" 32
 generate "$SECRETS/fuel-monitoring/fuel_db_password" 32
-generate "$SECRETS/fuel-monitoring/fuel_db_trino_password" 32
+generate "$SECRETS/fuel-monitoring/fuel_db_ro_password" 32
 # 32 hex characters = a 32-byte cookie key, as oauth2-proxy requires.
 generate "$SECRETS/traefik/oauth2_proxy_cookie_secret" 16
 
-# Trino reads the catalog password from its environment (${ENV:...}); keep the
-# env file in step with the secret file that fuel-db's init script uses.
-env_file=$ROOT/env/fuel-monitoring.env
-line="FUEL_DB_TRINO_PASSWORD=$(cat "$SECRETS/fuel-monitoring/fuel_db_trino_password")"
-if ! grep -qxF "$line" "$env_file" 2>/dev/null; then
-  printf '%s\n' "$line" >"$env_file.tmp"
-  chown root:deploy "$env_file.tmp"
-  chmod 0440 "$env_file.tmp"
-  mv "$env_file.tmp" "$env_file"
-  echo "wrote     $env_file"
-fi
-
 if [ ! -s "$SECRETS/shared/keycloak_petrolyst_client_secret" ]; then
   echo
   echo "Still missing: the Keycloak client secret. Copy it from Keycloak"