Hidden interfaces, last-seen pings, activity by subnet

- interfaces.exclude in steward.yaml (names or shell patterns) leaves
  interfaces out of GET /interfaces, the web UI's picker and
  'steward interface list'. Subnets on them are still served.
- With the ping check on, active leases are pinged every minute; a
  client that answers gets a last-seen time (leases.last_seen,
  migration 4). Not answering never takes a client offline.
- The activity log filters by subnet (--subnet, the Activity page,
  GET /events?subnet=).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/h_leases.go

@@ -153,7 +153,30 @@ func (s *Server) listEvents(w http.ResponseWriter, r *http.Request, p *auth.Prin
 	if err := require(p, auth.ResLeases, false); err != nil {
 		return err
 	}
-	evs := s.dhcp.Events(queryInt(r, "limit", 200), r.URL.Query().Get("mac"), r.URL.Query().Get("interface"))
+	q := r.URL.Query()
+	var only *model.Subnet
+	if ref := q.Get("subnet"); ref != "" {
+		var err error
+		if only, err = subnetRef(s.eng.State(), ref); err != nil {
+			return err
+		}
+	}
+	mac, iface := q.Get("mac"), q.Get("interface")
+	evs := s.dhcp.Events(queryInt(r, "limit", 200), func(e dhcpd.Event) bool {
+		if mac != "" && !strings.EqualFold(e.MAC, mac) || iface != "" && e.Interface != iface {
+			return false
+		}
+		if only != nil {
+			// A message with an address belongs to the subnet that has
+			// it; one without (a DISCOVER) to every subnet on its
+			// interface.
+			if ip, err := netip.ParseAddr(e.IP); err == nil {
+				return only.Prefix.Contains(ip)
+			}
+			return e.Interface == only.Interface
+		}
+		return true
+	})
 	out := make([]api.Event, len(evs))
 	for i, e := range evs {
 		out[i] = api.Event(e)