Petrolyst server infrastructure: Traefik, Trino and Superset

Traefik as the server-wide edge (TLS via Let's Encrypt, dashboard on
traefik.petrolyst.com behind oauth2-proxy and Keycloak). The
fuel-monitoring stack: Superset on atoma.petrolyst.com with Keycloak login
and Petrolyst branding, Trino reading the TimescaleDB fuel-db as catalog
"fuel". Customization lives in petrolyst-insights/, deployment in the other
folders.

Deploys run server-side (deploy/deploy.sh) from a Gitea workflow or
manually; releases are immutable, Superset metadata is backed up before
migrations, and deploy/rollback.sh restores it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

stacks/fuel-monitoring/fuel-db/init/01-roles.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Runs once, when the fuel-db volume is first initialised (mounted after the
+# image's own TimescaleDB scripts, as 010_petrolyst_roles.sh).
+#   fuel_owner  owns database "fuel", its public schema and every table in it.
+#               Loaders log in as their own role but act as fuel_owner (README
+#               "Data loaders"): the default privileges below cover only what
+#               fuel_owner itself creates, not what its members create.
+#   trino_ro    what Trino connects as: read-only, also on tables created later.
+set -euo pipefail
+
+trino_password=$(cat /run/secrets/fuel_db_trino_password)
+
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
+  -v trino_password="$trino_password" <<'SQL'
+CREATE ROLE fuel_owner NOLOGIN;
+ALTER DATABASE fuel OWNER TO fuel_owner;
+REVOKE CREATE ON SCHEMA public FROM PUBLIC;
+
+CREATE ROLE trino_ro LOGIN PASSWORD :'trino_password';
+GRANT CONNECT ON DATABASE fuel TO trino_ro;
+GRANT USAGE ON SCHEMA public TO trino_ro;
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO trino_ro;
+ALTER DEFAULT PRIVILEGES FOR ROLE fuel_owner IN SCHEMA public
+  GRANT SELECT ON TABLES TO trino_ro;
+SQL