Retire the Superset reader setup and the ATOMA dashboard (PD-13)

ATOMA's users use the Petrolyst app; Superset keeps admins, editors and the
app's embedded dashboards. Removed: the "ATOMA Reader" role and its rules
(petrolyst_reader.py, ReaderAccessMixin, reader.css, the head template, the
SQL-hiding patch), the atoma-reader mapping (it now maps to nothing in
Superset), the iframe allowance for the Map tab, and the "atoma" dashboard
with its Fleet/Map tab, D0 and dashboard.css. The bundle holds atoma-overview
and atoma-site only (byte-identical to before); the guest role keeps the
reader's 12 permissions in roles/atoma_guest.py. Brand files now name
petrolyst-web. SPEC marks the retired parts as history.

Checks (local): bundle checks pass; image rebuilt and healthy; import with
column drift 0 and unchanged embedding ids; the production config loads with
OAuth, embedding off, no reader hook; admin sees atoma-site with its tabs and
filter column; the app's browser tests pass 10/10. shellcheck not run (not
installed). Not deployed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

petrolyst-insights/dashboards/README.md

@@ -3,16 +3,11 @@
 Superset dashboards as code and the operator scripts that import them. Not baked into the
 image, so changes here do not rebuild or restart Superset.
 
-- `atoma/`: the ATOMA dashboard, with a Map tab (the fleet map) and an Insights tab (one site's
-  details), shown to readers as a lens switch in the navbar. `SPEC.md` is
-  the design; `build_bundle.py` generates the import bundle and `import_bundle.py` imports it
-  (overwriting the objects the bundle defines). `dashboard.css` is the dashboard's own CSS,
-  which the bundle carries.
-
-  The Fleet tab is an iframe of the fleet-map view from the petrolyst-platform repository. It
-  needs that view and its read service served on Superset's own origin under `/views`, and the
-  image's `superset_config.py` with the iframe setting (SPEC.md §6). Without them the tab stays
-  empty, and the Site details tab works as before.
+- `atoma/`: ATOMA's two dashboards for the Petrolyst app (PD-12, PD-13; SPEC.md §10):
+  `atoma-overview` (fleet totals) and `atoma-site` (one site, its four sections as tabs). The
+  app embeds them; admins open them in Superset, with the filter column. `SPEC.md` is the
+  design; `build_bundle.py` generates the import bundle and `import_bundle.py` imports it
+  (overwriting the objects the bundle defines).
 
   Build and import:
 
@@ -25,23 +20,16 @@ image, so changes here do not rebuild or restart Superset.
   Exit status 2 means a dataset's columns differ from its view: regenerate `atoma/columns.tsv`
   (command in its header), rebuild and import again.
 
-  The import attaches the role "ATOMA Reader" to the dashboard (a bundle cannot carry roles),
-  so the role must exist first: `superset-init` creates it (`petrolyst-insights/roles/`). The
-  Fleet tab shows ATOMA's logo from `petrolyst-insights/assets/branding/atoma_logo.svg`, in the
-  image.
+  An import never deletes. Where they exist, delete these by hand after importing: the
+  dashboards from before 28 Oct ("ATOMA - Sites", "ATOMA - Site Detail") and their charts M1,
+  M3, M4 and M5; the ATOMA dashboard (slug `atoma`, retired 29 Oct with PD-13) and its chart D0
+  "Site"; the one-tab dashboards `atoma-site-summary`, `-fuel`, `-runtime` and `-baseline`
+  (replaced by `atoma-site` on 29 Oct); and the role "ATOMA Reader".
 
-  An import never deletes. On an instance that still has the two dashboards from before
-  28 Oct 2026 ("ATOMA - Sites" and "ATOMA - Site Detail") and their charts M1, M3, M4 and M5,
-  delete those by hand after importing.
-
-  The bundle also carries the Petrolyst app's dashboards (PD-12, SPEC.md §10): `atoma-overview`
-  (fleet totals) and `atoma-site` (one site, its four sections as tabs; it replaced
-  `atoma-site-summary`, `-fuel`, `-runtime` and `-baseline` on 29 Oct: delete those by hand
-  where they exist).
-  They get no role; the app shows them with guest passes (see "Embedding" in the parent
-  README; local stack only). Add `--embedded-out FILE --embed-domain <app origin>` to the
+  The dashboards get no role; the app shows them with guest passes (see "Embedding" in the
+  parent README; local stack only). Add `--embedded-out FILE --embed-domain <app origin>` to the
   import to make them embeddable from the app's origin; FILE then receives
-  `{slug: embedding id}` for the app service. The ids stay the same across imports. Local
+  `{slug: embedding id}` for the Petrolyst server. The ids stay the same across imports. Local
   stack:
 
       docker exec fmdb-scratch-superset /app/.venv/bin/python /tmp/import_bundle.py /tmp/atoma-dashboards.zip \