Remove Trino: Superset reads fuel-db directly as fuel_ro (PD-14)

trino/ deleted; the role trino_ro becomes fuel_ro, its password read from a
secret file at connect time; dashboards' SQL and column list for PostgreSQL;
the Compose project is renamed petrolyst, with volumes pinned to their old
names. AGENTS.md points to the architecture context. Not deployed: the next
deploy needs README's one-time steps first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

stacks/fuel-monitoring/fuel-db/init/01-roles.sh

@@ -5,21 +5,24 @@
 #               Loaders log in as their own role but act as fuel_owner (README
 #               "Data loaders"): the default privileges below cover only what
 #               fuel_owner itself creates, not what its members create.
-#   trino_ro    what Trino connects as: read-only, also on tables created later.
+#   fuel_ro     what Superset and the Petrolyst server read as: SELECT on public,
+#               also on tables created later. Read-only by default as well: a
+#               second lock behind the grants.
 set -euo pipefail
 
-trino_password=$(cat /run/secrets/fuel_db_trino_password)
+ro_password=$(cat /run/secrets/fuel_db_ro_password)
 
 psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
-  -v trino_password="$trino_password" <<'SQL'
+  -v ro_password="$ro_password" <<'SQL'
 CREATE ROLE fuel_owner NOLOGIN;
 ALTER DATABASE fuel OWNER TO fuel_owner;
 REVOKE CREATE ON SCHEMA public FROM PUBLIC;
 
-CREATE ROLE trino_ro LOGIN PASSWORD :'trino_password';
-GRANT CONNECT ON DATABASE fuel TO trino_ro;
-GRANT USAGE ON SCHEMA public TO trino_ro;
-GRANT SELECT ON ALL TABLES IN SCHEMA public TO trino_ro;
+CREATE ROLE fuel_ro LOGIN PASSWORD :'ro_password';
+ALTER ROLE fuel_ro SET default_transaction_read_only = on;
+GRANT CONNECT ON DATABASE fuel TO fuel_ro;
+GRANT USAGE ON SCHEMA public TO fuel_ro;
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO fuel_ro;
 ALTER DEFAULT PRIVILEGES FOR ROLE fuel_owner IN SCHEMA public
-  GRANT SELECT ON TABLES TO trino_ro;
+  GRANT SELECT ON TABLES TO fuel_ro;
 SQL

stacks/fuel-monitoring/fuel-db/migrations/0002_fm_derivations.sql

@@ -1,4 +1,4 @@
--- 0002_fm_derivations.sql: internal derivations in schema `fm` (not visible to Trino).
+-- 0002_fm_derivations.sql: internal derivations in schema `fm` (not readable by fuel_ro).
 -- DRAFT, not applied. Applied after 0001 by a loader acting as fuel_owner (README in this folder).
 -- Design: fuel-monitoring .context/plans/2026-10-24-fuel-db-baseline-dashboard.md, §4 and §5.1.
 BEGIN;

stacks/fuel-monitoring/fuel-db/migrations/0003_bi_views.sql

@@ -1,7 +1,7 @@
--- 0003_bi_views.sql: the views Superset reads through Trino (schema `public`), plus
--- fm.v_site_baseline_status. Owned by fuel_owner, so trino_ro can read them through the existing
--- default privileges; they run with the owner's rights, so Trino never reads `fm` (it lists fm's
--- table names, as it lists every schema's, but any query on them is refused).
+-- 0003_bi_views.sql: the views Superset reads (schema `public`), plus
+-- fm.v_site_baseline_status. Owned by fuel_owner, so fuel_ro can read them through the existing
+-- default privileges; they run with the owner's rights, so fuel_ro never reads `fm` (the catalog
+-- shows fm's table names, as it shows every schema's, but any query on them is refused).
 -- DRAFT, not applied. Applied after 0002 by a loader acting as fuel_owner (README in this folder).
 -- Design: fuel-monitoring .context/plans/2026-10-24-fuel-db-baseline-dashboard.md, §5.2 and §6.
 BEGIN;
@@ -97,7 +97,7 @@ LEFT JOIN pp USING (site_uid) LEFT JOIN fm.v_site_baseline_status bs USING (site
 LEFT JOIN cal USING (site_uid) LEFT JOIN latest USING (site_uid);
 
 -- Every view below joins public.v_site for site_uid, site_code, site_name and site_label, so one
--- Site filter drives every dataset, and casts to Trino-safe types (varchar(n), integer,
+-- Site filter drives every dataset, and casts to plain types (varchar(n), integer,
 -- numeric(p,s), date, timestamp(0), boolean). Live = asserted, reviewed or disputed.
 
 -- S2, R3: one row per site and measure; the rows stay when a value is not established.

stacks/fuel-monitoring/fuel-db/migrations/README.md

@@ -10,7 +10,7 @@ The design and its rationale live in the fuel-monitoring corpus:
 
 ## Files
 
-| File | Creates | Visible to Trino |
+| File | Creates | Readable by `fuel_ro` (Superset, Petrolyst server) |
 |---|---|---|
 | `0001_fm_core.sql` | schema `fm`, `btree_gist` in it, 25 tables, constraints, trigger-backed rules 1–13 | no |
 | `0002_fm_derivations.sql` | internal views in `fm`: claims → visits → stock intervals → L/h and L/day intervals, dependency hashes, baseline validity | no |
@@ -21,7 +21,7 @@ Each file is one transaction. Apply them in order.
 ## Applying (on the server)
 
 1. Create a loader role as in the repository README, "Data loaders". Its sessions act as
-   `fuel_owner`, so every object belongs to `fuel_owner`. `trino_ro` can then read the `public`
+   `fuel_owner`, so every object belongs to `fuel_owner`. `fuel_ro` can then read the `public`
    views through the existing default privileges, with no role or grant changes.
 2. Open the tunnel and apply the three files as the loader:
 
@@ -32,13 +32,14 @@ Each file is one transaction. Apply them in order.
    done
    ```
 
-3. Check through Trino (`docker exec -it fuel-monitoring-trino-1 trino`):
-   - `SHOW TABLES FROM fuel.public` lists the 18 `v_*` views;
-   - `SELECT count(*) FROM fuel.fm.site` fails with "permission denied for schema fm".
+3. Check as `fuel_ro`
+   (`docker exec -it petrolyst-fuel-db-1 psql -U postgres -d fuel`, then `SET ROLE fuel_ro;`):
+   - `\dv public.*` lists the 18 `v_*` views;
+   - `SELECT count(*) FROM fm.site;` fails with "permission denied for schema fm".
 
-The `public` views are owned by `fuel_owner` and run with its rights, so Trino never needs, and
-never gets, read access to `fm`. Trino's metadata still lists fm's table and column names, as it
-lists every schema in fuel-db (TimescaleDB's internal ones included); names only, no rows.
+The `public` views are owned by `fuel_owner` and run with its rights, so `fuel_ro` never needs,
+and never gets, read access to `fm`. PostgreSQL's catalog still shows every schema's table and
+column names to any role, so Superset's SQL Lab can list fm's names; names only, no rows.
 
 ## Data
 
@@ -91,6 +92,8 @@ it, except baseline versions and their approvals, which live only in fuel-db: ex
 
 ## Verified locally (2026-10-24, scratch only)
 
+With Trino, before its removal on 29 Oct 2026; `trino_ro` is now `fuel_ro`.
+
 Setup:
 - `timescale/timescaledb:2.31.0-pg17`, with this repository's `01-roles.sh`;
 - a loader created by the README recipe;