Retire the Superset reader setup and the ATOMA dashboard (PD-13)

ATOMA's users use the Petrolyst app; Superset keeps admins, editors and the
app's embedded dashboards. Removed: the "ATOMA Reader" role and its rules
(petrolyst_reader.py, ReaderAccessMixin, reader.css, the head template, the
SQL-hiding patch), the atoma-reader mapping (it now maps to nothing in
Superset), the iframe allowance for the Map tab, and the "atoma" dashboard
with its Fleet/Map tab, D0 and dashboard.css. The bundle holds atoma-overview
and atoma-site only (byte-identical to before); the guest role keeps the
reader's 12 permissions in roles/atoma_guest.py. Brand files now name
petrolyst-web. SPEC marks the retired parts as history.

Checks (local): bundle checks pass; image rebuilt and healthy; import with
column drift 0 and unchanged embedding ids; the production config loads with
OAuth, embedding off, no reader hook; admin sees atoma-site with its tabs and
filter column; the app's browser tests pass 10/10. shellcheck not run (not
installed). Not deployed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

petrolyst-insights/petrolyst_security.py

@@ -11,9 +11,6 @@ the stock behaviour:
   login page on /login/, which only shows a "Sign in with keycloak" button.
 - /logout/ also ends the Keycloak session, so the next visit asks for the
   password and OTP again.
-
-It also takes the reader rules (petrolyst_reader.ReaderAccessMixin), as does the
-local stack's database-login manager.
 """
 
 import logging
@@ -27,7 +24,6 @@ from flask_appbuilder.utils.base import get_safe_redirect
 from flask_login import logout_user
 from werkzeug.wrappers import Response as WerkzeugResponse
 
-from petrolyst_reader import ReaderAccessMixin
 from superset.security import SupersetSecurityManager
 
 logger = logging.getLogger(__name__)
@@ -68,7 +64,7 @@ class PetrolystAuthOAuthView(AuthOAuthView):
         return redirect(f"{end_session}?{urlencode(params)}")
 
 
-class PetrolystSecurityManager(ReaderAccessMixin, SupersetSecurityManager):
+class PetrolystSecurityManager(SupersetSecurityManager):
     authoauthview = PetrolystAuthOAuthView
     # Without this, Superset registers its React login page on /login/ before
     # FAB's OAuth view, and that page wins the route.