Hidden interfaces, last-seen pings, activity by subnet

- interfaces.exclude in steward.yaml (names or shell patterns) leaves
  interfaces out of GET /interfaces, the web UI's picker and
  'steward interface list'. Subnets on them are still served.
- With the ping check on, active leases are pinged every minute; a
  client that answers gets a last-seen time (leases.last_seen,
  migration 4). Not answering never takes a client offline.
- The activity log filters by subnet (--subnet, the Activity page,
  GET /events?subnet=).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/development.md

@@ -55,6 +55,7 @@ It checks:
 
 * addresses and options per interface, and reservations;
 * the ping check, against a container that squats on a pool address;
+* last seen: a client that stays up answers pings, one that left has none;
 * init-reboot, renewal and release with dhcpcd;
 * a client moved to another VLAN: NAK, then that VLAN's address;
 * a full pool and a disabled subnet;