Petrolyst server infrastructure: Traefik, Trino and Superset

Traefik as the server-wide edge (TLS via Let's Encrypt, dashboard on
traefik.petrolyst.com behind oauth2-proxy and Keycloak). The
fuel-monitoring stack: Superset on atoma.petrolyst.com with Keycloak login
and Petrolyst branding, Trino reading the TimescaleDB fuel-db as catalog
"fuel". Customization lives in petrolyst-insights/, deployment in the other
folders.

Deploys run server-side (deploy/deploy.sh) from a Gitea workflow or
manually; releases are immutable, Superset metadata is backed up before
migrations, and deploy/rollback.sh restores it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

petrolyst-insights/dashboards/README.md

@@ -0,0 +1,14 @@
+# dashboards/
+
+Exported Superset dashboards and the operator scripts that import them. Not baked into the
+image, so changes here do not rebuild or restart Superset. Empty until the first fuel
+dashboards exist.
+
+Export from a running instance (inside the container, as the server's deploy user):
+
+    docker exec fuel-monitoring-superset-1 superset export-dashboards -f /tmp/dashboards.zip
+    docker cp fuel-monitoring-superset-1:/tmp/dashboards.zip .
+
+Import is the reverse with `superset import-dashboards -p <zip> -u <username>`. The
+username must be an existing Superset user, which here means someone who has signed in
+through Keycloak at least once.