Allow and deny lists per subnet; every option of a DHCP message in words

- A subnet is a deny-list subnet (the default: everyone not denied) or
  an allow-list subnet (only clients allowed or with a reservation);
  the deny list counts in both. Entries are MAC addresses, prefixes
  (aa:bb:cc:*) or client IDs. A refused client gets no answer (DENIED
  in the activity log, with an Allow button) or a NAK on renewal.
  steward access, the subnet's Access tab. Schema migration 7.
- The activity log keeps each message's header fields and options,
  decoded into words (dhcp4.Describe): the parameter request list by
  name, client IDs, lease times. ▸ on an Activity row, steward
  activity show N / --details, GET /events/{id}.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/h_leases.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"net/http"
 	"net/netip"
+	"strconv"
 	"strings"
 	"time"
 
@@ -201,14 +202,35 @@ func (s *Server) listEvents(w http.ResponseWriter, r *http.Request, p *auth.Prin
 		}
 		return true
 	})
+	details := q.Get("details") == "1"
 	out := make([]api.Event, len(evs))
 	for i, e := range evs {
+		if !details {
+			e.Fields, e.Options = nil, nil
+		}
 		out[i] = api.Event(e)
 	}
 	writeJSON(w, http.StatusOK, out)
 	return nil
 }
 
+// getEvent: GET /events/{id}, one message with its fields and options.
+func (s *Server) getEvent(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
+	if err := require(p, auth.ResLeases, false); err != nil {
+		return err
+	}
+	id, err := strconv.ParseUint(r.PathValue("id"), 10, 64)
+	if err != nil {
+		return badRequest("%q is not an event number", r.PathValue("id"))
+	}
+	e, ok := s.dhcp.Event(id)
+	if !ok {
+		return notFound("no event %d: only the last 1000 are kept, and none from before stewardd started", id)
+	}
+	writeJSON(w, http.StatusOK, api.Event(e))
+	return nil
+}
+
 // ---- status and audit
 
 func (s *Server) status(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {