Allow and deny lists per subnet; every option of a DHCP message in words

- A subnet is a deny-list subnet (the default: everyone not denied) or
  an allow-list subnet (only clients allowed or with a reservation);
  the deny list counts in both. Entries are MAC addresses, prefixes
  (aa:bb:cc:*) or client IDs. A refused client gets no answer (DENIED
  in the activity log, with an Allow button) or a NAK on renewal.
  steward access, the subnet's Access tab. Schema migration 7.
- The activity log keeps each message's header fields and options,
  decoded into words (dhcp4.Describe): the parameter request list by
  name, client IDs, lease times. ▸ on an Activity row, steward
  activity show N / --details, GET /events/{id}.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/types.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"time"
 
+	"steward/internal/dhcp4"
 	"steward/internal/model"
 	"steward/internal/validate"
 	"steward/internal/version"
@@ -81,12 +82,17 @@ type SubnetInput struct {
 	Pools     *[]string `json:"pools,omitempty"`
 	// PoolOrder is listed or random; AddressOrder sequential, reverse,
 	// random or "" (the settings').
-	PoolOrder    *string        `json:"pool_order,omitempty"`
-	AddressOrder *string        `json:"address_order,omitempty"`
-	LeaseTime    *int           `json:"lease_time,omitempty"`
-	Options      *[]OptionInput `json:"options,omitempty"`
-	Disabled     *bool          `json:"disabled,omitempty"`
-	Comment      *string        `json:"comment,omitempty"`
+	PoolOrder    *string `json:"pool_order,omitempty"`
+	AddressOrder *string `json:"address_order,omitempty"`
+	// Access is deny-list or allow-list; Allow and Deny replace the
+	// lists (entries: a MAC address, aa:bb:cc:* or "id HEX").
+	Access    *string              `json:"access,omitempty"`
+	Allow     *[]model.ClientMatch `json:"allow,omitempty"`
+	Deny      *[]model.ClientMatch `json:"deny,omitempty"`
+	LeaseTime *int                 `json:"lease_time,omitempty"`
+	Options   *[]OptionInput       `json:"options,omitempty"`
+	Disabled  *bool                `json:"disabled,omitempty"`
+	Comment   *string              `json:"comment,omitempty"`
 }
 
 // ReservationInput creates or changes a reservation (unset fields stay).
@@ -255,6 +261,18 @@ type Event struct {
 	IP        string    `json:"ip,omitempty"`
 	Hostname  string    `json:"hostname,omitempty"`
 	Detail    string    `json:"detail,omitempty"`
+	// ID numbers the events since stewardd started.
+	ID uint64 `json:"id"`
+	// Direction is "in" for a client's message, "out" for Steward's
+	// answer, "" for an event of Steward's own (CONFLICT, NO ADDRESS).
+	Direction string `json:"direction,omitempty"`
+	ClientID  string `json:"client_id,omitempty"`
+	// SubnetID is the subnet that refused a client (DENIED).
+	SubnetID int64 `json:"subnet_id,omitempty"`
+	// Fields and Options are the message, in words (GET /events/{id}, or
+	// ?details=1).
+	Fields  []dhcp4.Field `json:"fields,omitempty"`
+	Options []dhcp4.Field `json:"options,omitempty"`
 }
 
 // ImportResult reports a Kea import.