Petrolyst server infrastructure: Traefik, Trino and Superset

Traefik as the server-wide edge (TLS via Let's Encrypt, dashboard on
traefik.petrolyst.com behind oauth2-proxy and Keycloak). The
fuel-monitoring stack: Superset on atoma.petrolyst.com with Keycloak login
and Petrolyst branding, Trino reading the TimescaleDB fuel-db as catalog
"fuel". Customization lives in petrolyst-insights/, deployment in the other
folders.

Deploys run server-side (deploy/deploy.sh) from a Gitea workflow or
manually; releases are immutable, Superset metadata is backed up before
migrations, and deploy/rollback.sh restores it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

petrolyst-insights/patches/README.md

@@ -0,0 +1,16 @@
+# patches/
+
+Runtime patches applied while the Superset image is built
+(`stacks/fuel-monitoring/superset/Dockerfile`). Empty until Petrolyst needs one.
+
+Same convention as media-insights:
+
+- One file per fix, named `fix_<what>.py`. It patches files inside the installed image
+  (`/app/superset/...` or the venv), for changes that cannot be made through
+  `superset_config.py`.
+- `python3 fix_<what>.py` applies the patch; `python3 fix_<what>.py --verify` exits non-zero
+  unless the patched code is in place. Both must be idempotent.
+- The Dockerfile runs both for every `fix_*.py` and stops at the first failure, so a patch that
+  no longer applies to a new Superset version fails the build instead of shipping silently.
+- Everything in this folder is a build input: changing it gives the image a new tag and
+  recreates the `superset` container on the next deploy.