Retire the Superset reader setup and the ATOMA dashboard (PD-13)

ATOMA's users use the Petrolyst app; Superset keeps admins, editors and the
app's embedded dashboards. Removed: the "ATOMA Reader" role and its rules
(petrolyst_reader.py, ReaderAccessMixin, reader.css, the head template, the
SQL-hiding patch), the atoma-reader mapping (it now maps to nothing in
Superset), the iframe allowance for the Map tab, and the "atoma" dashboard
with its Fleet/Map tab, D0 and dashboard.css. The bundle holds atoma-overview
and atoma-site only (byte-identical to before); the guest role keeps the
reader's 12 permissions in roles/atoma_guest.py. Brand files now name
petrolyst-web. SPEC marks the retired parts as history.

Checks (local): bundle checks pass; image rebuilt and healthy; import with
column drift 0 and unchanged embedding ids; the production config loads with
OAuth, embedding off, no reader hook; admin sees atoma-site with its tabs and
filter column; the app's browser tests pass 10/10. shellcheck not run (not
installed). Not deployed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

petrolyst-insights/README.md

@@ -14,12 +14,10 @@ and where it runs lives in `stacks/`, `traefik/`, `deploy/` and `host/`.
 | Path | What it is | In the image at |
 |---|---|---|
 | `superset_config.py` | Keycloak sign-in, role mapping, proxy and cookie settings, Redis caches, theme and chart palettes | `/app/pythonpath/` |
-| `petrolyst_security.py` | `PetrolystSecurityManager`: user info and roles from the Keycloak ID token, `/login/` straight to Keycloak, `/logout/` through Keycloak; takes the reader rules | `/app/pythonpath/` |
-| `petrolyst_reader.py` | readers ("ATOMA Reader"): reach only dashboards granted to the role, own nothing, get no SQL; land on the ATOMA dashboard; `register` is `FLASK_APP_MUTATOR` | `/app/pythonpath/` |
-| `templates/` | `head_custom_extra.html`: loads `reader.css` for readers on every page | `/app/pythonpath/templates/` |
-| `roles/` | `atoma_reader.py`: the role "ATOMA Reader" with exactly its permissions, run by `superset-init`; `atoma_guest.py`: the role "ATOMA Guest" for the Petrolyst app's embedded dashboards, run by hand (see "Embedding") | `/app/petrolyst-roles/` |
-| `assets/branding/` | logos (full colour and white): the wordmark alone for the navbar, and the stacked logo; favicons, app icons; `reader.css`; ATOMA's logo for the fleet map | `/app/superset/static/assets/branding/`, served at `/static/assets/branding/…` |
-| `patches/` | runtime patches, `fix_*.py` with `--verify` (see its README): `fix_redact_query_for_readers.py` | `/app/patches/petrolyst/`, applied during the build |
+| `petrolyst_security.py` | `PetrolystSecurityManager`: user info and roles from the Keycloak ID token, `/login/` straight to Keycloak, `/logout/` through Keycloak | `/app/pythonpath/` |
+| `roles/` | `atoma_guest.py`: the role "ATOMA Guest" for the Petrolyst app's embedded dashboards, with exactly its permissions; run by hand (see "Embedding") | `/app/petrolyst-roles/` |
+| `assets/branding/` | logos (full colour and white): the wordmark alone for the navbar, and the stacked logo; favicons, app icons; ATOMA's logo, which the Petrolyst app shows in its map's corner (`PETROLYST_OPERATOR_LOGO`) | `/app/superset/static/assets/branding/`, served at `/static/assets/branding/…` |
+| `patches/` | runtime patches, `fix_*.py` with `--verify` (see its README); none at present | `/app/patches/petrolyst/`, applied during the build |
 | `dashboards/` | exported dashboards and import scripts (see its README) | not in the image |
 
 How the image consumes this folder: `stacks/fuel-monitoring/compose.yaml` passes it to the build
@@ -54,7 +52,7 @@ On the server they come from `/opt/petrolyst/secrets/` (see the deployment READM
   | `superset-admin` | Admin |
   | `superset-editor` | Alpha |
   | `superset-viewer` | Gamma |
-  | `atoma-reader` | ATOMA Reader: the ATOMA dashboard only, read-only (SPEC.md §6) |
+  | `atoma-reader` | none (Public): ATOMA's users use the Petrolyst app, not Superset (PD-13) |
   | none | Public (no permissions) |
 
 - `DASHBOARD_RBAC` is on: a viewer sees a dashboard once an admin adds the Gamma role (or a
@@ -64,7 +62,7 @@ On the server they come from `/opt/petrolyst/secrets/` (see the deployment READM
 
 ## Embedding (local trial only)
 
-The Petrolyst app (PD-12, petrolyst-platform `app/` and `services/app/`) shows dashboards inside
+The Petrolyst app (PD-12, petrolyst-platform `app/` and `server/`) shows dashboards inside
 its Insights lens with Superset guest passes. This is switched on **only in the local scratch
 stack** (`.local/fmdb-scratch`); `superset_config.py` here leaves it off, and loads without the
 guest secret.
@@ -72,10 +70,10 @@ guest secret.
 - The scratch stack's `superset_config_local.py` turns on `EMBEDDED_SUPERSET`, names the guest
   role `GUEST_ROLE_NAME = "ATOMA Guest"`, reads the signing secret with
   `_read_secret("superset_guest_token_secret")` and expects the audience `petrolyst-app`. The
-  app service signs the guest passes itself with the same secret.
-- `roles/atoma_guest.py` gives "ATOMA Guest" the same permissions as "ATOMA Reader". Which
+  Petrolyst server signs the guest passes itself with the same secret.
+- `roles/atoma_guest.py` gives "ATOMA Guest" exactly what a dashboard needs to be read. Which
   dashboard a guest sees comes from the pass, not the role. It is not in `init.sh`; run it once,
-  and again whenever the permissions in `atoma_reader.py` change:
+  and again whenever its permissions change:
 
       docker exec <superset> /app/.venv/bin/python /app/petrolyst-roles/atoma_guest.py
 
@@ -85,8 +83,8 @@ Production embedding is an open point of PD-12 (`.context/design-decisions.md`).
 
 ## Look and feel
 
-Source: `petrolyst-ui/design/brand/` (tokens `07_UI_Tokens/petrolyst_tokens.css`, logos
-`public/brand/`, favicons `03_Favicon_App_Icons/`), copied on 2026-10-23 from petrolyst-ui commit
+Source: `petrolyst-web/design/brand/` (tokens `07_UI_Tokens/petrolyst_tokens.css`, logos
+`public/brand/`, favicons `03_Favicon_App_Icons/`), copied on 2026-10-23 from petrolyst-web (then petrolyst-ui) commit
 `2b2e694`. Copy again when the brand changes.
 
 - Light theme: action teal `#00695C` for primary and links, navy `#0B1D33` text, `#F8FAFC`