Hidden interfaces, last-seen pings, activity by subnet

- interfaces.exclude in steward.yaml (names or shell patterns) leaves
  interfaces out of GET /interfaces, the web UI's picker and
  'steward interface list'. Subnets on them are still served.
- With the ping check on, active leases are pinged every minute; a
  client that answers gets a last-seen time (leases.last_seen,
  migration 4). Not answering never takes a client offline.
- The activity log filters by subnet (--subnet, the Activity page,
  GET /events?subnet=).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/server.go

@@ -12,6 +12,7 @@ import (
 	"net/http"
 	"net/netip"
 	"os"
+	"path"
 	"strconv"
 	"strings"
 	"sync"
@@ -44,6 +45,20 @@ type Config struct {
 	// ACME keeps the certificate stewardd obtains itself (tls.acme; nil
 	// when off).
 	ACME *certs.Manager
+	// ExcludeInterfaces are interface names or path.Match patterns left
+	// out of GET /interfaces (interfaces.exclude).
+	ExcludeInterfaces []string
+}
+
+// excludedInterface reports whether interfaces.exclude hides the
+// interface name.
+func (s *Server) excludedInterface(name string) bool {
+	for _, p := range s.cfg.ExcludeInterfaces {
+		if ok, _ := path.Match(p, name); ok {
+			return true
+		}
+	}
+	return false
 }
 
 // Interfaces lists the host's interfaces.