Hidden interfaces, last-seen pings, activity by subnet

- interfaces.exclude in steward.yaml (names or shell patterns) leaves
  interfaces out of GET /interfaces, the web UI's picker and
  'steward interface list'. Subnets on them are still served.
- With the ping check on, active leases are pinged every minute; a
  client that answers gets a last-seen time (leases.last_seen,
  migration 4). Not answering never takes a client offline.
- The activity log filters by subnet (--subnet, the Activity page,
  GET /events?subnet=).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/pages/settings.js

@@ -9,7 +9,7 @@ export async function render(el) {
   const s = await get("/settings");
   const write = can("config", true);
   const lease = input({ value: fmtSeconds(s.lease_time || 43200) });
-  const ping = checkbox("Ping an address before offering it, and skip it if something answers", s.ping_check);
+  const ping = checkbox("Ping an address before offering it, and skip it if something answers; also ping clients every minute for their last-seen time", s.ping_check);
   const timeout = input({ type: "number", min: 50, max: 5000, value: s.ping_timeout_ms || 500 });
   timeout.style.width = "7em";
   const hold = input({ value: fmtSeconds(s.decline_hold || 86400) });