Retire the Superset reader setup and the ATOMA dashboard (PD-13)

ATOMA's users use the Petrolyst app; Superset keeps admins, editors and the
app's embedded dashboards. Removed: the "ATOMA Reader" role and its rules
(petrolyst_reader.py, ReaderAccessMixin, reader.css, the head template, the
SQL-hiding patch), the atoma-reader mapping (it now maps to nothing in
Superset), the iframe allowance for the Map tab, and the "atoma" dashboard
with its Fleet/Map tab, D0 and dashboard.css. The bundle holds atoma-overview
and atoma-site only (byte-identical to before); the guest role keeps the
reader's 12 permissions in roles/atoma_guest.py. Brand files now name
petrolyst-web. SPEC marks the retired parts as history.

Checks (local): bundle checks pass; image rebuilt and healthy; import with
column drift 0 and unchanged embedding ids; the production config loads with
OAuth, embedding off, no reader hook; admin sees atoma-site with its tabs and
filter column; the app's browser tests pass 10/10. shellcheck not run (not
installed). Not deployed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

petrolyst-insights/patches/README.md

@@ -1,10 +1,7 @@
 # patches/
 
 Runtime patches applied while the Superset image is built
-(`stacks/fuel-monitoring/superset/Dockerfile`):
-
-- `fix_redact_query_for_readers.py`: chart-data responses carry no SQL for readers, as Superset
-  already does for embedded guests (`petrolyst_reader.py`).
+(`stacks/fuel-monitoring/superset/Dockerfile`). Empty until Petrolyst needs one.
 
 Same convention as media-insights:
 

petrolyst-insights/patches/fix_redact_query_for_readers.py

@@ -1,54 +0,0 @@
-"""Readers' chart-data responses carry no SQL.
-
-Superset 6.1.0 drops each query's SQL from chart-data JSON for embedded guest users only
-(superset/charts/data/api.py, ChartDataRestApi._send_chart_response). This extends that
-condition with the security manager's redacts_query(), when it has one: the Petrolyst managers
-return True for readers (petrolyst_reader.ReaderAccessMixin). It runs when the response is
-written, so cached results and result_type=query are covered too.
-
-    python3 fix_redact_query_for_readers.py           apply (idempotent)
-    python3 fix_redact_query_for_readers.py --verify  exit 1 unless applied
-"""
-
-import sys
-from pathlib import Path
-
-TARGET = Path("/app/superset/charts/data/api.py")
-BEFORE = """\
-            if security_manager.is_guest_user():
-                for query in queries:
-                    query.pop("query", None)
-"""
-AFTER = """\
-            # Petrolyst (patches/fix_redact_query_for_readers.py): readers too.
-            if security_manager.is_guest_user() or getattr(
-                security_manager, "redacts_query", lambda: False
-            )():
-                for query in queries:
-                    query.pop("query", None)
-"""
-
-
-def main(argv: list[str]) -> int:
-    text = TARGET.read_text()
-    if "--verify" in argv:
-        compile(text, str(TARGET), "exec")
-        if text.count(AFTER) == 1 and BEFORE not in text:
-            print(f"{TARGET}: readers' SQL redaction in place")
-            return 0
-        print(f"{TARGET}: readers' SQL redaction missing", file=sys.stderr)
-        return 1
-    if text.count(AFTER) == 1:
-        print(f"{TARGET}: already patched")
-        return 0
-    if text.count(BEFORE) != 1:
-        print(f"{TARGET}: the guest-only redaction was not found once; Superset changed?",
-              file=sys.stderr)
-        return 1
-    TARGET.write_text(text.replace(BEFORE, AFTER))
-    print(f"{TARGET}: patched")
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main(sys.argv[1:]))