Rebrand STEAM → AEGIS, fix BU drift checker previous_bu bug

- Replace all STEAM branding with AEGIS (Advanced Engineering Group
  Intelligence System) across login, header, nav drawer, manifest, and
  browser title
- Add shield logo to login page, main header, and nav drawer
- Fix BU drift checker recording incorrect previous_bu values by
  building a previousBuMap snapshot BEFORE the upsert/delete cycle
  instead of querying the DB after rows are already gone
- Clean 526 bogus BU history entries generated by the broken logic
- Add docs and scripts from prior session

.kiro/steering/tech.md

@@ -75,11 +75,36 @@ Python dependencies: `pandas>=2.0.0`, `openpyxl>=3.0.0` (install via apt or venv
 
 ## Environment Configuration
 
-- `backend/.env` — PORT, CORS_ORIGINS, SESSION_SECRET, NVD_API_KEY, Ivanti API credentials
+- `backend/.env` — PORT, CORS_ORIGINS, SESSION_SECRET, NVD_API_KEY, Ivanti API credentials, CARD API credentials
 - `frontend/.env` — REACT_APP_API_BASE, REACT_APP_API_HOST
 - Both `.env` files are gitignored; see `.env.example` files for templates.
 - React env vars are baked in at **build time** — you must rebuild (`npm run build`) after changing them.
 
+### Key Backend Env Vars
+
+| Variable | Purpose |
+|---|---|
+| `IVANTI_API_KEY` | RiskSense platform API key |
+| `IVANTI_CLIENT_ID` | RiskSense client ID (default: 1550) |
+| `IVANTI_BU_FILTER` | Comma-separated BU teams to sync findings for (default: `NTS-AEO-ACCESS-ENG,NTS-AEO-STEAM`) |
+| `IVANTI_FIRST_NAME` / `IVANTI_LAST_NAME` | Fallback Ivanti identity for workflow sync (used only if no per-user identities configured) |
+| `CARD_API_URL` | CARD API base URL (e.g., `https://card.charter.com`) |
+| `CARD_API_USER` / `CARD_API_PASS` | CARD OAuth credentials for Bearer token acquisition |
+| `CARD_SKIP_TLS` | Set to `true` to skip TLS verification (for SSL inspection proxies) |
+| `DATABASE_URL` | PostgreSQL connection string |
+
+### CARD API and Ivanti Integration Details
+
+See `.kiro/steering/integrations.md` for full API contracts, response shapes, and quirks for CARD, Ivanti, Atlas, and Jira.
+
+### Ivanti Findings IPv6 Handling
+
+Some Ivanti findings have no IPv4 address. The sync captures fallback addresses:
+- `qualys_ipv6` — from `hostAdditionalDetails[].["IPv6 Address"]` (resolves in CARD)
+- `primary_ipv6` — from `assetCustomAttributes['1550_host_6'][0]` (may not resolve in CARD)
+
+Display priority in the UI: IPv4 > Qualys IPv6 (amber "Q" badge) > Primary IPv6 (indigo "v6" badge)
+
 ## Code Style & Lint Rules
 
 ### Unused Variables