Petrolyst server infrastructure: Traefik, Trino and Superset

Traefik as the server-wide edge (TLS via Let's Encrypt, dashboard on
traefik.petrolyst.com behind oauth2-proxy and Keycloak). The
fuel-monitoring stack: Superset on atoma.petrolyst.com with Keycloak login
and Petrolyst branding, Trino reading the TimescaleDB fuel-db as catalog
"fuel". Customization lives in petrolyst-insights/, deployment in the other
folders.

Deploys run server-side (deploy/deploy.sh) from a Gitea workflow or
manually; releases are immutable, Superset metadata is backed up before
migrations, and deploy/rollback.sh restores it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

traefik/dynamic/middlewares.yml

@@ -0,0 +1,10 @@
+http:
+  middlewares:
+    # Response headers for every public router (reference as secure-headers@file).
+    secure-headers:
+      headers:
+        stsSeconds: 31536000
+        contentTypeNosniff: true
+        referrerPolicy: strict-origin-when-cross-origin
+        customFrameOptionsValue: SAMEORIGIN
+        permissionsPolicy: "camera=(), microphone=(), geolocation=()"

traefik/dynamic/tls.yml

@@ -0,0 +1,7 @@
+# Applies to every router: TLS 1.2 or newer (Exhibit B), and no certificate for
+# requests that do not name one of our hosts.
+tls:
+  options:
+    default:
+      minVersion: VersionTLS12
+      sniStrict: true