Refuse link-local addresses in the antispoof lists

fe80::/10 in the IPv6 antispoof list (or your prefixes) dropped the
ISP's router adverts and DHCPv6 replies in the early chain, before the
ICMPv6 and DHCPv6 client built-ins could accept them: the router lost
its IPv6 default route. Validation now refuses it
(antispoof_link_local), the settings page says so, and the importer
leaves it out with a note.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/rules.md

@@ -347,7 +347,12 @@ UI), and `hc ruleset` shows them:
 **Your prefixes** (`--own-prefix 2001:db8::/48`) are your delegated
 IPv6 prefix and public addresses: nothing from outside should come from
 them. The antispoof lists can be changed with `--antispoof-v4` and
-`--antispoof-v6`.
+`--antispoof-v6`. Link-local addresses (`fe80::/10`) are refused in the
+IPv6 list and in your prefixes (`antispoof_link_local`): your ISP's
+router sends its router adverts and DHCPv6 replies from them, and
+antispoofing runs in the early chain, before the ICMPv6 and DHCPv6
+client built-ins could accept them, so the router would lose its IPv6
+default route and, later, its delegated prefix.
 
 The **flowtable** (`--flowtable wan --flowtable eth1`) lets established
 TCP and UDP connections forwarded between those devices skip the rules,