Allow and deny lists per subnet; every option of a DHCP message in words

- A subnet is a deny-list subnet (the default: everyone not denied) or
  an allow-list subnet (only clients allowed or with a reservation);
  the deny list counts in both. Entries are MAC addresses, prefixes
  (aa:bb:cc:*) or client IDs. A refused client gets no answer (DENIED
  in the activity log, with an Allow button) or a NAK on renewal.
  steward access, the subnet's Access tab. Schema migration 7.
- The activity log keeps each message's header fields and options,
  decoded into words (dhcp4.Describe): the parameter request list by
  name, client IDs, lease times. ▸ on an Activity row, steward
  activity show N / --details, GET /events/{id}.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to Steward are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow
 [Semantic Versioning](https://semver.org/).
 
+## [Unreleased]
+
+### Added
+
+- **Allow and deny lists per subnet** (docs/subnets.md): a deny-list
+  subnet (the default) answers everyone not denied; an allow-list subnet
+  only clients allowed or with a reservation. Entries are MAC addresses,
+  prefixes (`aa:bb:cc:*`) or client IDs. A refused client gets no answer
+  (DENIED in the activity log, with an Allow button), or a NAK when it
+  next renews. `steward access`, the subnet's Access tab, `access`,
+  `allow` and `deny` in the API.
+- **Every option of a DHCP message, in words:** ▸ on an Activity row,
+  `steward activity show N` or `--details`, and `GET /events/{id}`. What
+  the client asked for (its parameter request list, by name), its client
+  ID and host name, and what Steward sent back.
+
+### Upgrading from 0.1
+
+- The database gets a new version (7), applied when stewardd starts; a
+  0.1 stewardd can't open it afterwards, so take a backup first (`sudo
+  stewardd backup`). Every subnet stays a deny-list subnet with empty
+  lists, so nothing changes until you add entries.
+
 ## [0.1.0] - 2026-10-18
 
 The first version of Steward, a DHCPv4 server with a web UI, a REST API