Refuse link-local addresses in the antispoof lists

fe80::/10 in the IPv6 antispoof list (or your prefixes) dropped the
ISP's router adverts and DHCPv6 replies in the early chain, before the
ICMPv6 and DHCPv6 client built-ins could accept them: the router lost
its IPv6 default route. Validation now refuses it
(antispoof_link_local), the settings page says so, and the importer
leaves it out with a note.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/pages/settings.js

@@ -54,7 +54,7 @@ export async function render(el) {
       field("Built-ins", h("div", { class: "checks" }, bis.map(([, c]) => c))),
       field("Your prefixes", own, "Your public prefixes (your delegated IPv6 /48): they can't come from outside."),
       field("Antispoof IPv4", v4),
-      field("Antispoof IPv6", v6),
+      field("Antispoof IPv6", v6, "Never link-local (fe80::/10): your ISP's router adverts and DHCPv6 replies come from it."),
       field("Flowtable", flow, "Forwarded TCP and UDP between these devices skip the rules once established (fast path): for a CPU that can't keep up with the line. Forward quotas, byte rates and traffic per device then only count first packets (docs/flowtable.md). Exact names, both sides (wan and lan); none: off."),
       field("Probation", probation, "How long a change made over the network has to be confirmed before it is rolled back."),
       h("label"), manual,