Allow and deny lists per subnet; every option of a DHCP message in words

- A subnet is a deny-list subnet (the default: everyone not denied) or
  an allow-list subnet (only clients allowed or with a reservation);
  the deny list counts in both. Entries are MAC addresses, prefixes
  (aa:bb:cc:*) or client IDs. A refused client gets no answer (DENIED
  in the activity log, with an Allow button) or a NAK on renewal.
  steward access, the subnet's Access tab. Schema migration 7.
- The activity log keeps each message's header fields and options,
  decoded into words (dhcp4.Describe): the parameter request list by
  name, client IDs, lease times. ▸ on an Activity row, steward
  activity show N / --details, GET /events/{id}.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/subnets.md

@@ -201,6 +201,45 @@ renewed, and is kept across restarts.
 `steward lease delete IP` frees an address at once. A client still using
 it gets a NAK when it next renews, then asks for a new address.
 
+## Access: allow and deny lists
+
+A subnet decides who it answers:
+
+* **deny-list** (the default): every client except those on its deny
+  list;
+* **allow-list**: only clients on its allow list or with a reservation in
+  it, and not on its deny list.
+
+The deny list counts in both modes, and wins over a reservation; so an
+allow-list subnet can allow a maker's devices by prefix and still deny one
+of them. Switching the mode keeps both lists.
+
+Entries are a MAC address (`aa:bb:cc:dd:ee:ff`), a prefix for one maker's
+devices (`aa:bb:cc:*`, 1 to 5 bytes) or a client identifier
+(`id 01aabbccddeeff`), each with an optional comment:
+
+```sh
+steward access mode iot allow-list
+steward access allow iot aa:bb:cc:* --comment "Sonos speakers"
+steward access deny office 3c:22:fb:11:22:33 --comment "old laptop"
+steward access remove office 3c:22:fb:11:22:33
+steward access show iot
+```
+
+In the web UI it is a subnet's **Access** tab; a DENIED line in Activity
+has an **Allow** button that puts that client on the subnet's allow list.
+
+A refused client gets **no answer**: its DISCOVER shows as `DENIED` in the
+activity log, with the reason. A client refused after it got its lease
+gets a **NAK** when it next renews, so it stops using the address then
+(within half its lease time).
+
+This is a control, not security: anyone can copy an allowed MAC address.
+Phones and laptops also use a **private MAC address** per network by
+default (iOS, Android, Windows), different from the one on their label;
+on an allow-list subnet, turn that off for the network on the device, or
+allow the private address it shows (Activity lists it).
+
 ## Authority
 
 Steward is **authoritative** for its interfaces. A client that asks to