Hidden interfaces, last-seen pings, activity by subnet

- interfaces.exclude in steward.yaml (names or shell patterns) leaves
  interfaces out of GET /interfaces, the web UI's picker and
  'steward interface list'. Subnets on them are still served.
- With the ping check on, active leases are pinged every minute; a
  client that answers gets a last-seen time (leases.last_seen,
  migration 4). Not answering never takes a client offline.
- The activity log filters by subnet (--subnet, the Activity page,
  GET /events?subnet=).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/subnets.md

@@ -20,7 +20,9 @@ For VLANs, give the server an interface on each, such as `eth0.20`, or a
 bridge such as `br-iot`, each with an address in its subnet. That address
 is the server identifier clients see, and the one they renew their lease
 with. `steward interface list` shows the server's interfaces with their
-addresses and subnets.
+addresses and subnets. To keep interfaces such as `lo`, `docker0` or
+`veth*` out of that list and the web UI's picker, name them in
+`interfaces.exclude` in steward.yaml ([configuration.md](configuration.md)).
 
 An interface that doesn't exist yet is fine. The subnet gets a warning
 (`interface_unknown`), and stewardd starts serving it within 30 seconds of
@@ -143,6 +145,17 @@ then is the ACK sent.
 `steward lease list` shows active and held-back leases; `--all` shows
 the others too. Leases that ended more than 30 days ago are deleted.
 
+### Online and last seen
+
+A client is **online** while its lease is active. With the ping check on
+(the default), Steward also pings every active lease's address once a
+minute, and a client that answers gets a **last seen** time: on the
+Leases page, next to a reservation's online badge, and in `steward lease
+list`. Many devices block pings (Windows' firewall does by default), so a
+client that doesn't answer stays online and simply has no last-seen time,
+or keeps the one it had. The time stays with the lease when it is
+renewed, and is kept across restarts.
+
 `steward lease delete IP` frees an address at once. A client still using
 it gets a NAK when it next renews, then asks for a new address.