Retire the Superset reader setup and the ATOMA dashboard (PD-13)

ATOMA's users use the Petrolyst app; Superset keeps admins, editors and the
app's embedded dashboards. Removed: the "ATOMA Reader" role and its rules
(petrolyst_reader.py, ReaderAccessMixin, reader.css, the head template, the
SQL-hiding patch), the atoma-reader mapping (it now maps to nothing in
Superset), the iframe allowance for the Map tab, and the "atoma" dashboard
with its Fleet/Map tab, D0 and dashboard.css. The bundle holds atoma-overview
and atoma-site only (byte-identical to before); the guest role keeps the
reader's 12 permissions in roles/atoma_guest.py. Brand files now name
petrolyst-web. SPEC marks the retired parts as history.

Checks (local): bundle checks pass; image rebuilt and healthy; import with
column drift 0 and unchanged embedding ids; the production config loads with
OAuth, embedding off, no reader hook; admin sees atoma-site with its tabs and
filter column; the app's browser tests pass 10/10. shellcheck not run (not
installed). Not deployed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

petrolyst-insights/superset_config.py

@@ -13,7 +13,6 @@ from copy import deepcopy
 from flask_appbuilder.security.manager import AUTH_OAUTH
 from sqlalchemy.engine.url import URL
 
-import petrolyst_reader
 from petrolyst_security import PetrolystSecurityManager
 from superset import config as superset_defaults
 
@@ -80,8 +79,7 @@ AUTH_ROLES_MAPPING = {
     "superset-admin": ["Admin"],
     "superset-editor": ["Alpha"],
     "superset-viewer": ["Gamma"],
-    # ATOMA's users: read the ATOMA dashboard, nothing else (petrolyst_reader.py).
-    "atoma-reader": ["ATOMA Reader"],
+    # "atoma-reader" opens the Petrolyst app only; here it maps to nothing (Public).
 }
 AUTH_ROLES_SYNC_AT_LOGIN = True
 AUTH_USER_REGISTRATION = True
@@ -95,27 +93,13 @@ AUTH_USER_REGISTRATION_ROLE = "Public"
 # opens it from a link.
 FEATURE_FLAGS = {"DASHBOARD_RBAC": True, "FILTERBAR_CLOSED_BY_DEFAULT": True}
 
-# Readers ("ATOMA Reader"): land on the ATOMA dashboard, see it without the
-# title row and the menus Superset shows to everyone, and reach no other
-# dashboard (petrolyst_reader.py).
-FLASK_APP_MUTATOR = petrolyst_reader.register
-
 # deck.gl maps: OpenStreetMap raster tiles only. The default list adds Mapbox
 # styles, which fail without MAPBOX_API_KEY. The default CSP already allows the
-# tile host. The ATOMA map credits OSM in a Markdown block beside it.
+# tile host.
 DECKGL_BASE_MAP = [
     ["tile://https://tile.openstreetmap.org/{z}/{x}/{y}.png", "OpenStreetMap"],
 ]
 
-# Markdown blocks may hold an iframe: the ATOMA Fleet tab embeds the fleet-map view
-# from petrolyst-platform (/views/fleet-map/). Only these attributes survive. The CSP
-# (default-src 'self', no frame-src) keeps frames to this origin, so a dashboard
-# editor cannot embed another site.
-HTML_SANITIZATION_SCHEMA_EXTENSIONS = {
-    "tagNames": ["iframe"],
-    "attributes": {"iframe": ["src", "title", "loading", "style"]},
-}
-
 # --- Behind Traefik -----------------------------------------------------------
 ENABLE_PROXY_FIX = True
 PREFERRED_URL_SCHEME = "https"
@@ -155,7 +139,7 @@ EXPLORE_FORM_DATA_CACHE_CONFIG = {
 RATELIMIT_STORAGE_URI = f"{REDIS_URL}/1"
 
 # --- Petrolyst look and feel --------------------------------------------------
-# Values from petrolyst-ui/design/brand/07_UI_Tokens/petrolyst_tokens.css.
+# Values from petrolyst-web/design/brand/07_UI_Tokens/petrolyst_tokens.css.
 # Assets live in assets/branding/ and are served from /static/assets/branding/.
 BRANDING = "/static/assets/branding"
 
@@ -178,7 +162,7 @@ THEME_DEFAULT["token"].update(
         # letters were about 5px high. Its own Y carries the brand accent. 24px
         # (letters about 20px) and the margin fill the 60px navbar height. On the
         # left, 15px more than the navbar's 16px: the P (1.4px inside the image)
-        # lines up with the dashboard's content and a reader's fleet map at 32px.
+        # lines up with the dashboard's content at 32px.
         "brandLogoHeight": "24px",
         "brandLogoMargin": "18px 0 18px 15px",
         # Action teal, not the raw brand teal #009688: the brand guide keeps