Hidden interfaces, last-seen pings, activity by subnet

- interfaces.exclude in steward.yaml (names or shell patterns) leaves
  interfaces out of GET /interfaces, the web UI's picker and
  'steward interface list'. Subnets on them are still served.
- With the ping check on, active leases are pinged every minute; a
  client that answers gets a last-seen time (leases.last_seen,
  migration 4). Not answering never takes a client offline.
- The activity log filters by subnet (--subnet, the Activity page,
  GET /events?subnet=).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/model/lease.go

@@ -34,6 +34,9 @@ type Lease struct {
 	// Interface is where the client was last seen.
 	Interface string    `json:"interface"`
 	Updated   time.Time `json:"updated"`
+	// LastSeen is when the client last answered a ping (nil: never).
+	// Clients that block pings stay online while their lease lasts.
+	LastSeen *time.Time `json:"last_seen,omitempty"`
 }
 
 // StateAt is the lease's state at a time (an active lease past its end