Retire the Superset reader setup and the ATOMA dashboard (PD-13)

ATOMA's users use the Petrolyst app; Superset keeps admins, editors and the
app's embedded dashboards. Removed: the "ATOMA Reader" role and its rules
(petrolyst_reader.py, ReaderAccessMixin, reader.css, the head template, the
SQL-hiding patch), the atoma-reader mapping (it now maps to nothing in
Superset), the iframe allowance for the Map tab, and the "atoma" dashboard
with its Fleet/Map tab, D0 and dashboard.css. The bundle holds atoma-overview
and atoma-site only (byte-identical to before); the guest role keeps the
reader's 12 permissions in roles/atoma_guest.py. Brand files now name
petrolyst-web. SPEC marks the retired parts as history.

Checks (local): bundle checks pass; image rebuilt and healthy; import with
column drift 0 and unchanged embedding ids; the production config loads with
OAuth, embedding off, no reader hook; admin sees atoma-site with its tabs and
filter column; the app's browser tests pass 10/10. shellcheck not run (not
installed). Not deployed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -110,11 +110,10 @@ deploy secrets.
    enrols first. Other clients of the realm are unaffected. There is no silent SSO between
    Superset and the dashboard.
 4. Give people roles: Users → (user) → Role mapping → Assign role → filter by clients →
-   `petrolyst`. Group mappings work too. ATOMA's users get `atoma-reader` and nothing else.
-   They then see only the ATOMA dashboard: no menus, nothing to edit, and Settings offers only
-   Logout (Superset role "ATOMA Reader", `petrolyst-insights/roles/atoma_reader.py`).
-   A realm that already has the client gets the new role by hand (Clients → petrolyst →
-   Roles → Create role) or by importing again with "Skip".
+   `petrolyst`. Group mappings work too. ATOMA's users get `atoma-reader` and nothing else:
+   it opens the Petrolyst app (petrolyst-platform) and maps to no Superset role, so in
+   Superset they see nothing. A realm that already has the client gets the role by hand
+   (Clients → petrolyst → Roles → Create role) or by importing again with "Skip".
 5. Users of the Traefik dashboard need **Email verified** switched on, because oauth2-proxy
    refuses unverified addresses.
 
@@ -165,7 +164,6 @@ becomes the first Superset admin; there is no local admin account.
 | fuel-db from the Mac | `ssh -L 5433:127.0.0.1:5433 petrolyst`, then connect to `localhost:5433`, database `fuel` |
 | Logs | `docker compose -p fuel-monitoring logs -f superset` (or `-p traefik`) |
 | Superset break-glass | `docker exec -it fuel-monitoring-superset-1 superset fab ...` |
-| Reset the role "ATOMA Reader" (after an edit in the UI) | `docker exec fuel-monitoring-superset-1 /app/.venv/bin/python /app/petrolyst-roles/atoma_reader.py`; a deploy does it whenever the Superset image changes |
 
 **Manual deploy**, the only way to deploy (there is no CI runner). On the Mac, in this
 repository: