Refuse link-local addresses in the antispoof lists

fe80::/10 in the IPv6 antispoof list (or your prefixes) dropped the
ISP's router adverts and DHCPv6 replies in the early chain, before the
ICMPv6 and DHCPv6 client built-ins could accept them: the router lost
its IPv6 default route. Validation now refuses it
(antispoof_link_local), the settings page says so, and the importer
leaves it out with a note.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/validate/validate.go

@@ -174,6 +174,8 @@ func (c *checker) settings() {
 			}
 			if l.v6 != 2 && a.IsV6() != (l.v6 == 1) {
 				c.add(Error, "settings_address", "settings", "%s: %s is the wrong address family", l.name, e)
+			} else if a.Overlaps(model.LinkLocal6) {
+				c.add(Error, "antispoof_link_local", "settings", "%s: %s holds link-local addresses (fe80::/10), which your ISP's router sends its router adverts and DHCPv6 replies from: dropping them on external zones loses the IPv6 default route, and later the delegated prefix. Link-local addresses never come from the internet anyway; take %s out", l.name, e, e)
 			}
 		}
 	}

internal/validate/validate_test.go

@@ -68,6 +68,9 @@ func TestCodes(t *testing.T) {
 		{"forward_name", func(st *model.State) { st.Forwards[0].Name = "jelly fin" }},
 		{"policy", func(st *model.State) { st.Settings.InputPolicy = "reject" }},
 		{"settings_address", func(st *model.State) { st.Settings.AntispoofV4 = []string{"fc00::/7"} }},
+		{"antispoof_link_local", func(st *model.State) { st.Settings.AntispoofV6 = []string{"fc00::/7", "fe80::/10"} }},
+		{"antispoof_link_local", func(st *model.State) { st.Settings.OwnPrefixes = []string{"fe80::/64"} }},
+		{"antispoof_link_local", func(st *model.State) { st.Settings.AntispoofV6 = []string{"::/0"} }},
 		{"flowtable_device", func(st *model.State) { st.Settings.FlowtableDevices = []string{"eth*"} }},
 		{"probation_range", func(st *model.State) { st.Settings.ProbationSeconds = 5 }},
 		{"zone_empty", func(st *model.State) { st.Zones[1].Interfaces = nil }},