Allow and deny lists per subnet; every option of a DHCP message in words

- A subnet is a deny-list subnet (the default: everyone not denied) or
  an allow-list subnet (only clients allowed or with a reservation);
  the deny list counts in both. Entries are MAC addresses, prefixes
  (aa:bb:cc:*) or client IDs. A refused client gets no answer (DENIED
  in the activity log, with an Allow button) or a NAK on renewal.
  steward access, the subnet's Access tab. Schema migration 7.
- The activity log keeps each message's header fields and options,
  decoded into words (dhcp4.Describe): the parameter request list by
  name, client IDs, lease times. ▸ on an Activity row, steward
  activity show N / --details, GET /events/{id}.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/e2e.sh

@@ -240,6 +240,33 @@ run "reservation lease time" 0 S reservation update $NA.20 --lease-time 2h
 run "the reserved client gets it" 0 udhcpc a 02:00:00:00:00:20
 contains "BOUND ip=$NA.20 .*lease=7200"
 
+# ---- every option of a message
+
+run "activity with details" 0 S activity --mac 02:00:00:00:00:20 --limit 4 -d
+contains "parameter-request-list: "
+contains "option 51 lease-time: 7200 s (2h)"
+ID=$(S activity --mac 02:00:00:00:00:20 --limit 1 | sed -n 's/^#\([0-9]*\) .*/\1/p' | tail -1)
+run "one message" 0 S activity show "$ID"
+contains "DHCPACK on eth0"
+contains "server-identifier: $NA.2"
+
+# ---- allow and deny lists
+
+run "deny a client" 0 S access deny iot 02:00:00:00:00:50 --comment "test"
+run "a denied client gets nothing" 1 udhcpc b 02:00:00:00:00:50
+run "activity says it was denied" 0 S activity --mac 02:00:00:00:00:50
+contains "DENIED.*deny list of iot .*(test)"
+run "allow-list mode" 0 S access mode iot allow-list
+run "an unlisted client gets nothing" 1 udhcpc b 02:00:00:00:00:51
+run "allow by prefix" 0 S access allow iot "02:00:00:00:00:*"
+run "now it gets an address" 0 udhcpc b 02:00:00:00:00:51
+contains "BOUND ip=$NB."
+run "the deny list still wins" 1 udhcpc b 02:00:00:00:00:50
+run "access shows it all" 0 S access show iot
+contains "allow-list: 1 allowed"
+run "back to a deny-list subnet" 0 S access mode iot deny-list
+run "remove the entries" 0 S access remove iot 02:00:00:00:00:50 "02:00:00:00:00:*"
+
 # ---- backup
 
 run "backup" 0 docker exec ${P}-srv /w/stewardd -c /w/steward.yaml backup