Steward 0.1.0 (in development): a DHCPv4 server with a web UI, API and CLI

Subnets served per interface, pools, reservations, options at three
levels, leases in SQLite saved before the ACK, ping and decline conflict
checks, validated changes with history and undo, users and tokens, an
audit log, a Kea importer, a sandboxed systemd unit and Debian packages.
Tested with real udhcpc and dhcpcd clients in Docker (scripts/e2e.sh).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/systemd/steward.service

@@ -0,0 +1,63 @@
+# Steward: the DHCP server, its REST API and web UI.
+# Installed as /etc/systemd/system/steward.service (see docs/install.md).
+[Unit]
+Description=Steward DHCP server (with web UI and API)
+Documentation=file:///usr/local/share/doc/steward/README.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=notify
+NotifyAccess=main
+ExecStart=/usr/local/bin/stewardd --config /etc/steward/steward.yaml serve
+# SIGHUP rereads the TLS certificate.
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+RestartSec=2s
+
+User=steward
+Group=steward
+UMask=0027
+
+# /var/lib/steward: the database (configuration and leases).
+StateDirectory=steward
+StateDirectoryMode=0750
+ConfigurationDirectory=steward
+ConfigurationDirectoryMode=0750
+# /run/steward: the local API socket (steward.sock), for root and the
+# steward user.
+RuntimeDirectory=steward
+RuntimeDirectoryMode=0750
+
+# Sandboxing: stewardd writes only its own state.
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+NoNewPrivileges=yes
+# The only privilege stewardd gets: listening on ports below 1024 (DHCP's
+# port 67). Binding each socket to its interface (SO_BINDTODEVICE) and the
+# ping check (an unprivileged ping socket) need nothing more.
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+# AF_NETLINK lets stewardd read the interfaces and their addresses.
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+
+[Install]
+WantedBy=multi-user.target
+# 'systemctl restart stewardd' works too (the daemon's binary is stewardd).
+Alias=stewardd.service