Refuse link-local addresses in the antispoof lists

fe80::/10 in the IPv6 antispoof list (or your prefixes) dropped the
ISP's router adverts and DHCPv6 replies in the early chain, before the
ICMPv6 and DHCPv6 client built-ins could accept them: the router lost
its IPv6 default route. Validation now refuses it
(antispoof_link_local), the settings page says so, and the importer
leaves it out with a note.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/importer/importer.go

@@ -1502,7 +1502,15 @@ func (im *importer) builtinOf(chain string, p *parsed) string {
 		}
 		set := &im.st.Settings
 		if p.family == "ipv6" {
-			set.OwnPrefixes = append(set.OwnPrefixes, p.src...)
+			for _, s := range p.src {
+				// Dropping link-local on an external zone loses the ISP's
+				// router adverts and DHCPv6 replies.
+				if a, err := model.ParseAddress(s); err == nil && a.Overlaps(model.LinkLocal6) {
+					im.note("antispoofing: %s left out: it holds link-local addresses, which the ISP's router adverts and DHCPv6 replies come from", s)
+					continue
+				}
+				set.OwnPrefixes = append(set.OwnPrefixes, s)
+			}
 			im.st.Settings.AntispoofV6 = nil
 		} else {
 			set.AntispoofV4 = p.src