Petrolyst server infrastructure: Traefik, Trino and Superset

Traefik as the server-wide edge (TLS via Let's Encrypt, dashboard on
traefik.petrolyst.com behind oauth2-proxy and Keycloak). The
fuel-monitoring stack: Superset on atoma.petrolyst.com with Keycloak login
and Petrolyst branding, Trino reading the TimescaleDB fuel-db as catalog
"fuel". Customization lives in petrolyst-insights/, deployment in the other
folders.

Deploys run server-side (deploy/deploy.sh) from a Gitea workflow or
manually; releases are immutable, Superset metadata is backed up before
migrations, and deploy/rollback.sh restores it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

stacks/fuel-monitoring/superset/init.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# superset-init: migrate the metadata database, sync roles and permissions, and
+# register the Trino connection. It is copied into the Superset image, so a
+# change here changes the image tag; deploy/deploy.sh runs it on a fresh install
+# and whenever that tag changes. Every step is idempotent. Unlike the
+# upstream docker-init.sh it never creates a local admin: users come from
+# Keycloak.
+set -euo pipefail
+
+superset db upgrade
+superset init
+superset set-database-uri \
+  --database_name "Fuel (Trino)" \
+  --uri "trino://superset@trino:8080/fuel"