Petrolyst server infrastructure: Traefik, Trino and Superset

Traefik as the server-wide edge (TLS via Let's Encrypt, dashboard on
traefik.petrolyst.com behind oauth2-proxy and Keycloak). The
fuel-monitoring stack: Superset on atoma.petrolyst.com with Keycloak login
and Petrolyst branding, Trino reading the TimescaleDB fuel-db as catalog
"fuel". Customization lives in petrolyst-insights/, deployment in the other
folders.

Deploys run server-side (deploy/deploy.sh) from a Gitea workflow or
manually; releases are immutable, Superset metadata is backed up before
migrations, and deploy/rollback.sh restores it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

keycloak/petrolyst-partial-import.json

@@ -0,0 +1,56 @@
+{
+  "clients": [
+    {
+      "clientId": "petrolyst",
+      "name": "Petrolyst",
+      "description": "Petrolyst apps on the petrolyst server: Superset at atoma.petrolyst.com and the Traefik dashboard at traefik.petrolyst.com (oauth2-proxy). Managed from petrolyst-infra/keycloak/.",
+      "enabled": true,
+      "protocol": "openid-connect",
+      "publicClient": false,
+      "clientAuthenticatorType": "client-secret",
+      "standardFlowEnabled": true,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "serviceAccountsEnabled": false,
+      "frontchannelLogout": true,
+      "baseUrl": "https://atoma.petrolyst.com/",
+      "redirectUris": [
+        "https://atoma.petrolyst.com/oauth-authorized/keycloak",
+        "https://traefik.petrolyst.com/oauth2/callback"
+      ],
+      "webOrigins": ["+"],
+      "attributes": {
+        "pkce.code.challenge.method": "S256",
+        "post.logout.redirect.uris": "https://atoma.petrolyst.com/*##https://traefik.petrolyst.com/*"
+      },
+      "protocolMappers": [
+        {
+          "name": "petrolyst client roles",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-client-role-mapper",
+          "consentRequired": false,
+          "config": {
+            "usermodel.clientRoleMapping.clientId": "petrolyst",
+            "multivalued": "true",
+            "claim.name": "petrolyst_roles",
+            "jsonType.label": "String",
+            "id.token.claim": "true",
+            "access.token.claim": "true",
+            "userinfo.token.claim": "true",
+            "introspection.token.claim": "true"
+          }
+        }
+      ]
+    }
+  ],
+  "roles": {
+    "client": {
+      "petrolyst": [
+        { "name": "superset-admin", "description": "Superset Admin at atoma.petrolyst.com" },
+        { "name": "superset-editor", "description": "Superset Alpha: build charts and dashboards" },
+        { "name": "superset-viewer", "description": "Superset Gamma: view dashboards shared with the role" },
+        { "name": "traefik-admin", "description": "Traefik dashboard at traefik.petrolyst.com" }
+      ]
+    }
+  }
+}