Petrolyst server infrastructure: Traefik, Trino and Superset

Traefik as the server-wide edge (TLS via Let's Encrypt, dashboard on
traefik.petrolyst.com behind oauth2-proxy and Keycloak). The
fuel-monitoring stack: Superset on atoma.petrolyst.com with Keycloak login
and Petrolyst branding, Trino reading the TimescaleDB fuel-db as catalog
"fuel". Customization lives in petrolyst-insights/, deployment in the other
folders.

Deploys run server-side (deploy/deploy.sh) from a Gitea workflow or
manually; releases are immutable, Superset metadata is backed up before
migrations, and deploy/rollback.sh restores it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

traefik/static/traefik.yml

@@ -0,0 +1,56 @@
+# Traefik static configuration: the server-wide edge for every stack under
+# stacks/. Changing anything in static/ changes TRAEFIK_CONFIG_HASH, so deploy.sh
+# recreates the container; ../dynamic/ is watched and applies without a restart.
+global:
+  checkNewVersion: false
+  sendAnonymousUsage: false
+
+entryPoints:
+  web:
+    address: ":80"
+    http:
+      redirections:
+        entryPoint:
+          to: websecure
+          scheme: https
+          permanent: true
+  websecure:
+    address: ":443"
+  # Internal only (not published): serves /ping for the healthcheck.
+  traefik:
+    address: ":8080"
+
+certificatesResolvers:
+  le:
+    acme:
+      # No e-mail: Let's Encrypt no longer sends expiry mail, and renewal is
+      # automatic. deploy.sh checks the certificates on every deploy.
+      storage: /letsencrypt/acme.json
+      httpChallenge:
+        entryPoint: web
+
+# The dashboard is served at traefik.petrolyst.com through api@internal, behind
+# Keycloak (labels on the traefik service in compose.yaml). No insecure port.
+api:
+  dashboard: true
+
+ping:
+  entryPoint: traefik
+
+providers:
+  docker:
+    # Through docker-socket-proxy (read-only container listing and events);
+    # Traefik never mounts the Docker socket itself.
+    endpoint: tcp://socket-proxy:2375
+    exposedByDefault: false
+    network: proxy
+  file:
+    directory: /etc/traefik/dynamic
+    watch: true
+
+log:
+  level: INFO
+  format: json
+
+accessLog:
+  format: json