Allow and deny lists per subnet; every option of a DHCP message in words

- A subnet is a deny-list subnet (the default: everyone not denied) or
  an allow-list subnet (only clients allowed or with a reservation);
  the deny list counts in both. Entries are MAC addresses, prefixes
  (aa:bb:cc:*) or client IDs. A refused client gets no answer (DENIED
  in the activity log, with an Allow button) or a NAK on renewal.
  steward access, the subnet's Access tab. Schema migration 7.
- The activity log keeps each message's header fields and options,
  decoded into words (dhcp4.Describe): the parameter request list by
  name, client IDs, lease times. ▸ on an Activity row, steward
  activity show N / --details, GET /events/{id}.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/routes.go

@@ -60,6 +60,7 @@ func (s *Server) routes() {
 	m.HandleFunc("DELETE "+p+"/leases/{ip}", s.authed(s.deleteLease))
 	m.HandleFunc("POST "+p+"/leases/{ip}/reserve", s.authed(s.reserveLease))
 	m.HandleFunc("GET "+p+"/events", s.authed(s.listEvents))
+	m.HandleFunc("GET "+p+"/events/{id}", s.authed(s.getEvent))
 	// Status and audit
 	m.HandleFunc("GET "+p+"/status", s.authed(s.status))
 	m.HandleFunc("GET "+p+"/audit", s.authed(s.listAudit))