Add atlas_known distinction to prevent badge noise for untracked hosts

Atlas sync now distinguishes between hosts Atlas actively tracks (returned
plans, active or inactive) vs hosts with empty responses (not in Atlas).
Only atlas_known hosts show the badge — ACCESS-OPS hosts not covered by
Atlas won't show the amber '0' warning badge anymore.

Changes:
- Migration adds atlas_known BOOLEAN column to atlas_action_plans_cache
- Sync sets atlas_known = true only when Atlas returns at least one plan
- Metrics endpoint only counts atlas_known hosts in its aggregation
- Status endpoint includes atlas_known in response
- AtlasBadge renders nothing when atlas_known = false
- Bulk-create and refresh-cache upserts set atlas_known = true
- Backfill marks existing hosts with plans + managed BU hosts as known

backend/db-schema.sql

@@ -398,6 +398,7 @@ CREATE TABLE IF NOT EXISTS atlas_action_plans_cache (
     has_action_plan BOOLEAN NOT NULL DEFAULT FALSE,
     plan_count INTEGER NOT NULL DEFAULT 0,
     plans_json TEXT NOT NULL DEFAULT '[]',
+    atlas_known BOOLEAN NOT NULL DEFAULT FALSE,
     synced_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );