Allow and deny lists per subnet; every option of a DHCP message in words

- A subnet is a deny-list subnet (the default: everyone not denied) or
  an allow-list subnet (only clients allowed or with a reservation);
  the deny list counts in both. Entries are MAC addresses, prefixes
  (aa:bb:cc:*) or client IDs. A refused client gets no answer (DENIED
  in the activity log, with an Allow button) or a NAK on renewal.
  steward access, the subnet's Access tab. Schema migration 7.
- The activity log keeps each message's header fields and options,
  decoded into words (dhcp4.Describe): the parameter request list by
  name, client IDs, lease times. ▸ on an Activity row, steward
  activity show N / --details, GET /events/{id}.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/validation.md

@@ -63,6 +63,11 @@ These apply to options anywhere (settings, subnets, reservations).
 | `reservation_network_address` | error | the network or broadcast address of its subnet |
 | `reservation_ip_taken` | error | the address is reserved already |
 | `reservation_client_taken` | error | the client has a reservation in this subnet already (one per subnet; a device on two VLANs may have one in each) |
+| `reservation_denied` | warning | a reservation's client is on its subnet's deny list, so it gets no address |
+| `access_mode` | error | a subnet's access is not `deny-list` or `allow-list` |
+| `access_entry` | error | an allow or deny list entry that isn't a MAC address, a prefix (`aa:bb:cc:*`) or `id HEX` |
+| `access_entry_duplicate` | error | an entry is on the same list twice |
+| `allow_list_empty` | warning | an allow-list subnet with no allow list entries and no reservations: nobody gets an address |
 | `reservation_hostname` | error | not a host name (letters, digits and `-`, labels up to 63 characters) |
 | `reservation_server_address` | warning, host | the server's own address |