Hidden interfaces, last-seen pings, activity by subnet

- interfaces.exclude in steward.yaml (names or shell patterns) leaves
  interfaces out of GET /interfaces, the web UI's picker and
  'steward interface list'. Subnets on them are still served.
- With the ping check on, active leases are pinged every minute; a
  client that answers gets a last-seen time (leases.last_seen,
  migration 4). Not answering never takes a client offline.
- The activity log filters by subnet (--subnet, the Activity page,
  GET /events?subnet=).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/server_test.go

@@ -11,6 +11,7 @@ import (
 	"net/http/cookiejar"
 	"net/http/httptest"
 	"net/netip"
+	"net/url"
 	"strings"
 	"testing"
 
@@ -246,6 +247,16 @@ func TestLeasesThroughDHCP(t *testing.T) {
 	if len(evs) != 4 || evs[0].Type != "DHCPACK" {
 		t.Errorf("events %+v", evs)
 	}
+	// By subnet: its addresses, and DISCOVERs on its interface.
+	e.call(e.token, "POST", "/subnets", api.SubnetInput{Name: ptr("office"), Prefix: ptr("10.0.10.0/24"), Interface: ptr("eth0")}, nil)
+	for ref, want := range map[string]int{"iot": 4, "10.0.20.0/24": 4, "office": 0} {
+		if code := e.call(e.token, "GET", "/events?subnet="+url.QueryEscape(ref), nil, &evs); code != 200 || len(evs) != want {
+			t.Errorf("events of subnet %s: %d %+v", ref, code, evs)
+		}
+	}
+	if code := e.call(e.token, "GET", "/events?subnet=nope", nil, nil); code != 404 && code != 400 {
+		t.Errorf("unknown subnet: %d", code)
+	}
 	if code := e.call(e.token, "DELETE", "/leases/"+ip, nil, nil); code != 204 {
 		t.Errorf("delete lease: %d", code)
 	}
@@ -380,3 +391,17 @@ func TestTokenRotation(t *testing.T) {
 		t.Errorf("a token rotating itself: %d", code)
 	}
 }
+
+func TestInterfacesExclude(t *testing.T) {
+	e := newEnv(t)
+	e.srv.cfg.ExcludeInterfaces = []string{"eth0.*", "docker*"}
+	// A subnet on an excluded interface the host doesn't have.
+	if c := e.call(e.token, "POST", "/subnets", api.SubnetInput{Prefix: ptr("172.17.0.0/16"), Interface: ptr("docker0")}, nil); c != 201 {
+		t.Fatalf("create: %d", c)
+	}
+	var ifs []api.HostInterface
+	e.call(e.token, "GET", "/interfaces", nil, &ifs)
+	if len(ifs) != 1 || ifs[0].Name != "eth0" {
+		t.Errorf("interfaces: %+v", ifs)
+	}
+}