Allow and deny lists per subnet; every option of a DHCP message in words

- A subnet is a deny-list subnet (the default: everyone not denied) or
  an allow-list subnet (only clients allowed or with a reservation);
  the deny list counts in both. Entries are MAC addresses, prefixes
  (aa:bb:cc:*) or client IDs. A refused client gets no answer (DENIED
  in the activity log, with an Allow button) or a NAK on renewal.
  steward access, the subnet's Access tab. Schema migration 7.
- The activity log keeps each message's header fields and options,
  decoded into words (dhcp4.Describe): the parameter request list by
  name, client IDs, lease times. ▸ on an Activity row, steward
  activity show N / --details, GET /events/{id}.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/engine/engine.go

@@ -436,6 +436,15 @@ func Normalize(st *model.State) {
 		if s.PoolOrder == model.PoolsListed {
 			s.PoolOrder = ""
 		}
+		if s.Access == model.AccessDenyList {
+			s.Access = ""
+		}
+		if len(s.Allow) == 0 {
+			s.Allow = nil
+		}
+		if len(s.Deny) == 0 {
+			s.Deny = nil
+		}
 	}
 	for _, r := range st.Reservations {
 		r.Options = normOptions(r.Options)