Hidden interfaces, last-seen pings, activity by subnet

- interfaces.exclude in steward.yaml (names or shell patterns) leaves
  interfaces out of GET /interfaces, the web UI's picker and
  'steward interface list'. Subnets on them are still served.
- With the ping check on, active leases are pinged every minute; a
  client that answers gets a last-seen time (leases.last_seen,
  migration 4). Not answering never takes a client offline.
- The activity log filters by subnet (--subnet, the Activity page,
  GET /events?subnet=).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -105,6 +105,16 @@ and a CLI, built the way Jarl is.
 - **Disabled reservations** (`steward reservation disable|enable`, Disable
   in the web UI): kept but ignored, so the client gets a pool address like
   any other. Subnets get Disable/Enable buttons in the web UI too.
+- **Hidden interfaces:** `interfaces.exclude` in `steward.yaml` (names or
+  shell patterns such as `docker*`) leaves interfaces out of the web UI's
+  interface picker, `steward interface list` and `GET /interfaces`.
+- **Last seen:** with the ping check on, active leases' addresses are
+  pinged every minute, and a client that answers gets a last-seen time
+  (Leases page, reservations' online badge, `steward lease list|show`,
+  `steward reservation list|show`, `last_seen` in the API). A client that
+  blocks pings stays online for as long as its lease lasts, without one.
+- **Activity by subnet:** `steward activity --subnet`, a subnet filter on
+  the Activity page, `GET /events?subnet=` (ID, name or prefix).
 - **Token rotation** (`steward token rotate`, `POST /tokens/{id}/rotate`,
   Rotate in the web UI): a new secret for a token, with an optional grace
   period for the old one, as in Jarl.