Fix atlas_known — managed BU hosts always show badge regardless of plans

A STEAM/ACCESS-ENG host with zero Atlas plans but tracked in Atlas
(like olt01k7) wasn't showing the amber shield because atlas_known
was only true when plans existed. Now managed BU hosts always get
atlas_known=true so the '0 plans' warning badge renders. Non-managed
BU hosts only show badge if Atlas actually has plan data for them.

backend/routes/atlas.js

@@ -251,6 +251,19 @@ function createAtlasRouter() {
                 return res.json({ synced: 0, withPlans: 0, failed: 0 });
             }
 
+            // Build a set of host IDs belonging to managed BUs — these always show the badge
+            const managedPatterns = managedBUs.map(b => `%${b}%`);
+            let managedHostIds = new Set();
+            try {
+                const { rows: managedRows } = await pool.query(
+                    `SELECT DISTINCT host_id FROM ivanti_findings
+                     WHERE host_id IS NOT NULL AND host_id > 0
+                       AND bu_ownership ILIKE ANY($1::text[])`,
+                    [managedPatterns]
+                );
+                managedHostIds = new Set(managedRows.map(r => r.host_id));
+            } catch (_) { /* non-fatal — fall back to plans-only logic */ }
+
             let synced = 0;
             let withPlans = 0;
             let failed = 0;
@@ -273,6 +286,7 @@ function createAtlasRouter() {
                     }
 
                     const { hostId, result } = settled.value;
+                    const isManagedHost = managedHostIds.has(hostId);
 
                     if (result.status >= 200 && result.status < 300) {
                         let allPlans = [];
@@ -294,9 +308,11 @@ function createAtlasRouter() {
 
                         const planCount = activePlans.length;
                         const hasActionPlan = planCount > 0;
-                        // Atlas "knows" this host if it returned any plans (active or inactive).
+                        // Atlas "knows" this host if:
-                        // Hosts with completely empty responses are not tracked by Atlas.
+                        // 1. It returned any plans (active or inactive), OR
-                        const atlasKnown = allPlans.length > 0;
+                        // 2. The host belongs to a managed BU (these should always show the badge)
+                        // Non-managed BU hosts with empty responses don't get a badge.
+                        const atlasKnown = allPlans.length > 0 || isManagedHost;
 
                         try {
                             if (!hasActionPlan) {