Add atlas_known distinction to prevent badge noise for untracked hosts

Atlas sync now distinguishes between hosts Atlas actively tracks (returned
plans, active or inactive) vs hosts with empty responses (not in Atlas).
Only atlas_known hosts show the badge — ACCESS-OPS hosts not covered by
Atlas won't show the amber '0' warning badge anymore.

Changes:
- Migration adds atlas_known BOOLEAN column to atlas_action_plans_cache
- Sync sets atlas_known = true only when Atlas returns at least one plan
- Metrics endpoint only counts atlas_known hosts in its aggregation
- Status endpoint includes atlas_known in response
- AtlasBadge renders nothing when atlas_known = false
- Bulk-create and refresh-cache upserts set atlas_known = true
- Backfill marks existing hosts with plans + managed BU hosts as known

frontend/src/components/AtlasBadge.js

@@ -49,6 +49,9 @@ export default function AtlasBadge({ hostId, atlasStatus, onClick }) {
   // No status data — render nothing
   if (!atlasStatus) return null;
 
+  // Host not tracked by Atlas — render nothing (avoids noise from BUs not covered)
+  if (atlasStatus.atlas_known === false) return null;
+
   const hasPlan = atlasStatus.plan_count > 0;
   const style = hasPlan ? successStyle : warningStyle;
   const label = hasPlan ? String(atlasStatus.plan_count) : '0';