Allow and deny lists per subnet; every option of a DHCP message in words

- A subnet is a deny-list subnet (the default: everyone not denied) or
  an allow-list subnet (only clients allowed or with a reservation);
  the deny list counts in both. Entries are MAC addresses, prefixes
  (aa:bb:cc:*) or client IDs. A refused client gets no answer (DENIED
  in the activity log, with an Allow button) or a NAK on renewal.
  steward access, the subnet's Access tab. Schema migration 7.
- The activity log keeps each message's header fields and options,
  decoded into words (dhcp4.Describe): the parameter request list by
  name, client IDs, lease times. ▸ on an Activity row, steward
  activity show N / --details, GET /events/{id}.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/store.go

@@ -210,6 +210,12 @@ ALTER TABLE subnets ADD COLUMN address_order TEXT NOT NULL DEFAULT '';
 	// 6: a reservation's own lease time.
 	`
 ALTER TABLE reservations ADD COLUMN lease_time INTEGER NOT NULL DEFAULT 0;
+`,
+	// 7: who a subnet answers: its access mode and allow and deny lists.
+	`
+ALTER TABLE subnets ADD COLUMN access TEXT NOT NULL DEFAULT '';
+ALTER TABLE subnets ADD COLUMN allow_list TEXT NOT NULL DEFAULT '[]';
+ALTER TABLE subnets ADD COLUMN deny_list TEXT NOT NULL DEFAULT '[]';
 `,
 }