Refuse link-local addresses in the antispoof lists

fe80::/10 in the IPv6 antispoof list (or your prefixes) dropped the
ISP's router adverts and DHCPv6 replies in the early chain, before the
ICMPv6 and DHCPv6 client built-ins could accept them: the router lost
its IPv6 default route. Validation now refuses it
(antispoof_link_local), the settings page says so, and the importer
leaves it out with a note.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/validate/validate_test.go

@@ -68,6 +68,9 @@ func TestCodes(t *testing.T) {
 		{"forward_name", func(st *model.State) { st.Forwards[0].Name = "jelly fin" }},
 		{"policy", func(st *model.State) { st.Settings.InputPolicy = "reject" }},
 		{"settings_address", func(st *model.State) { st.Settings.AntispoofV4 = []string{"fc00::/7"} }},
+		{"antispoof_link_local", func(st *model.State) { st.Settings.AntispoofV6 = []string{"fc00::/7", "fe80::/10"} }},
+		{"antispoof_link_local", func(st *model.State) { st.Settings.OwnPrefixes = []string{"fe80::/64"} }},
+		{"antispoof_link_local", func(st *model.State) { st.Settings.AntispoofV6 = []string{"::/0"} }},
 		{"flowtable_device", func(st *model.State) { st.Settings.FlowtableDevices = []string{"eth*"} }},
 		{"probation_range", func(st *model.State) { st.Settings.ProbationSeconds = 5 }},
 		{"zone_empty", func(st *model.State) { st.Zones[1].Interfaces = nil }},