Hidden interfaces, last-seen pings, activity by subnet

- interfaces.exclude in steward.yaml (names or shell patterns) leaves
  interfaces out of GET /interfaces, the web UI's picker and
  'steward interface list'. Subnets on them are still served.
- With the ping check on, active leases are pinged every minute; a
  client that answers gets a last-seen time (leases.last_seen,
  migration 4). Not answering never takes a client offline.
- The activity log filters by subnet (--subnet, the Activity page,
  GET /events?subnet=).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/pages/leases.js

@@ -20,6 +20,7 @@ export function leasesTable(leases, done, opts = {}) {
     { label: "Host name", render: leaseHost },
     { label: "State", render: (l) => [stateBadge(l.state), l.reservation ? [" ", badge("reserved", "accent")] : null] },
     { label: "Ends", render: (l) => time(l.end) },
+    { label: "Last seen", render: (l) => l.last_seen ? time(l.last_seen) : "" },
     opts.subnet ? null : { label: "Subnet", render: (l) => l.subnet || "–" },
     { label: "Interface", render: (l) => h("span", { class: "mono" }, l.interface) },
     { label: "", tdClass: "actions-cell", render: (l) => [