Remove Trino: Superset reads fuel-db directly as fuel_ro (PD-14)

trino/ deleted; the role trino_ro becomes fuel_ro, its password read from a
secret file at connect time; dashboards' SQL and column list for PostgreSQL;
the Compose project is renamed petrolyst, with volumes pinned to their old
names. AGENTS.md points to the architecture context. Not deployed: the next
deploy needs README's one-time steps first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

stacks/fuel-monitoring/fuel-db/migrations/README.md

@@ -10,7 +10,7 @@ The design and its rationale live in the fuel-monitoring corpus:
 
 ## Files
 
-| File | Creates | Visible to Trino |
+| File | Creates | Readable by `fuel_ro` (Superset, Petrolyst server) |
 |---|---|---|
 | `0001_fm_core.sql` | schema `fm`, `btree_gist` in it, 25 tables, constraints, trigger-backed rules 1–13 | no |
 | `0002_fm_derivations.sql` | internal views in `fm`: claims → visits → stock intervals → L/h and L/day intervals, dependency hashes, baseline validity | no |
@@ -21,7 +21,7 @@ Each file is one transaction. Apply them in order.
 ## Applying (on the server)
 
 1. Create a loader role as in the repository README, "Data loaders". Its sessions act as
-   `fuel_owner`, so every object belongs to `fuel_owner`. `trino_ro` can then read the `public`
+   `fuel_owner`, so every object belongs to `fuel_owner`. `fuel_ro` can then read the `public`
    views through the existing default privileges, with no role or grant changes.
 2. Open the tunnel and apply the three files as the loader:
 
@@ -32,13 +32,14 @@ Each file is one transaction. Apply them in order.
    done
    ```
 
-3. Check through Trino (`docker exec -it fuel-monitoring-trino-1 trino`):
-   - `SHOW TABLES FROM fuel.public` lists the 18 `v_*` views;
-   - `SELECT count(*) FROM fuel.fm.site` fails with "permission denied for schema fm".
+3. Check as `fuel_ro`
+   (`docker exec -it petrolyst-fuel-db-1 psql -U postgres -d fuel`, then `SET ROLE fuel_ro;`):
+   - `\dv public.*` lists the 18 `v_*` views;
+   - `SELECT count(*) FROM fm.site;` fails with "permission denied for schema fm".
 
-The `public` views are owned by `fuel_owner` and run with its rights, so Trino never needs, and
-never gets, read access to `fm`. Trino's metadata still lists fm's table and column names, as it
-lists every schema in fuel-db (TimescaleDB's internal ones included); names only, no rows.
+The `public` views are owned by `fuel_owner` and run with its rights, so `fuel_ro` never needs,
+and never gets, read access to `fm`. PostgreSQL's catalog still shows every schema's table and
+column names to any role, so Superset's SQL Lab can list fm's names; names only, no rows.
 
 ## Data
 
@@ -91,6 +92,8 @@ it, except baseline versions and their approvals, which live only in fuel-db: ex
 
 ## Verified locally (2026-10-24, scratch only)
 
+With Trino, before its removal on 29 Oct 2026; `trino_ro` is now `fuel_ro`.
+
 Setup:
 - `timescale/timescaledb:2.31.0-pg17`, with this repository's `01-roles.sh`;
 - a loader created by the README recipe;