Allow and deny lists per subnet; every option of a DHCP message in words

- A subnet is a deny-list subnet (the default: everyone not denied) or
  an allow-list subnet (only clients allowed or with a reservation);
  the deny list counts in both. Entries are MAC addresses, prefixes
  (aa:bb:cc:*) or client IDs. A refused client gets no answer (DENIED
  in the activity log, with an Allow button) or a NAK on renewal.
  steward access, the subnet's Access tab. Schema migration 7.
- The activity log keeps each message's header fields and options,
  decoded into words (dhcp4.Describe): the parameter request list by
  name, client IDs, lease times. ▸ on an Activity row, steward
  activity show N / --details, GET /events/{id}.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/dhcpd/config.go

@@ -109,6 +109,12 @@ func (c *config) reservationFor(subnetID int64, cl client) *model.Reservation {
 	return m["mac "+cl.mac]
 }
 
+// admits says whether the subnet answers the client (its allow and deny
+// lists), and if not why.
+func (c *config) admits(sub *subnet, cl client) (bool, string) {
+	return sub.Admits(cl.mac, cl.id, c.reservationFor(sub.ID, cl) != nil)
+}
+
 // subnetFor finds the interface's subnet holding a.
 func (c *config) subnetFor(iface string, a netip.Addr) *subnet {
 	for _, s := range c.byIface[iface] {