Hidden interfaces, last-seen pings, activity by subnet

- interfaces.exclude in steward.yaml (names or shell patterns) leaves
  interfaces out of GET /interfaces, the web UI's picker and
  'steward interface list'. Subnets on them are still served.
- With the ping check on, active leases are pinged every minute; a
  client that answers gets a last-seen time (leases.last_seen,
  migration 4). Not answering never takes a client offline.
- The activity log filters by subnet (--subnet, the Activity page,
  GET /events?subnet=).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/cli.md

@@ -75,7 +75,7 @@ one. An option Steward doesn't know: `--option 224:string=hello`.
 
 | Command | |
 |---|---|
-| `reservation list [--subnet SUBNET]` | reservations, and whether each client is online |
+| `reservation list [--subnet SUBNET]` | reservations, whether each client is online, and when it last answered a ping |
 | `reservation show RES` | RES is its ID, address or MAC address |
 | `reservation add IP MAC [--hostname H] [--client-id HEX] [--option NAME=VALUE]... [--comment C]` | `-` for MAC with `--client-id` |
 | `reservation update RES [--ip] [--mac] [--client-id] [--hostname] [--option]... [--unset-option]... [--comment]` | |
@@ -93,9 +93,11 @@ one. An option Steward doesn't know: `--option 224:string=hello`.
 
 ### activity
 
-`steward activity [--mac MAC] [--interface I] [--limit N] [-f]`: the latest
-DHCP messages, received and sent, oldest first. `-f` keeps watching, which
-is useful while a device tries to get an address:
+`steward activity [--mac MAC] [--subnet SUBNET] [--interface I] [--limit N] [-f]`:
+the latest DHCP messages, received and sent, oldest first. `--subnet`
+takes an ID, name or prefix; a message without an address (a DISCOVER,
+"no address") shows for every subnet on its interface. `-f` keeps
+watching, which is useful while a device tries to get an address:
 
 ```
 11:02:13.120  eth0     DHCPDISCOVER  3c:22:fb:11:22:33 -               adams-macbook
@@ -115,7 +117,7 @@ sent.
 | `settings show` | |
 | `settings set [--lease-time 1d] [--ping-check on\|off] [--ping-timeout 500ms] [--decline-hold 24h] [--authoritative on\|off] [--option NAME=VALUE]... [--unset-option NAME]...` | |
 | `option list` | the options Steward knows ([options.md](options.md)) |
-| `interface list` | the server's interfaces, their addresses and subnets |
+| `interface list` | the server's interfaces, their addresses and subnets (not those in `interfaces.exclude`) |
 
 ### history