Fix owner-lookup hostId fast path — use asset-search owner data directly

The asset-search response wraps in { assets: [...] } and includes the full
owner record. Previously we tried to extract just an _id from the top level
(which didn't exist) and then made a separate getOwner() call that returned
empty data for IPv6 assets.

Now when hostId resolves via asset-search, we return the owner data directly
from the search response — no second API call needed. This fixes the tooltip
showing empty confirmed/unconfirmed for IPv6-only findings.

backend/routes/cardApi.js

@@ -595,14 +595,28 @@ function createCardApiRouter() {
         const hostId = req.query.hostId;
 
         // Fast path: if Ivanti hostId is provided, try asset-search first
+        // The asset-search returns the full record including owner data, so we can
+        // return directly without a separate getOwner() call.
         let assetId = null;
         if (hostId && /^\d+$/.test(hostId)) {
             try {
                 const searchResult = await searchByIvantiHostId(hostId);
                 if (searchResult.ok) {
                     const searchData = JSON.parse(searchResult.body);
-                    // Extract asset_id from the search response (_id field or asset_id)
+                    const assets = searchData.assets || [];
-                    assetId = searchData._id || searchData.asset_id || searchData.id || null;
+                    if (assets.length > 0) {
+                        const asset = assets[0];
+                        const owner = asset.owner || {};
+                        return res.json({
+                            asset_id: asset._id || null,
+                            ip: ip.trim(),
+                            confirmed: owner.confirmed || null,
+                            unconfirmed: owner.unconfirmed || null,
+                            declined: owner.declined || [],
+                            candidate: owner.candidate || [],
+                            update_token: owner.update_token || null,
+                        });
+                    }
                 }
             } catch (_) {
                 // Fall through to suffix resolution