Hidden interfaces, last-seen pings, activity by subnet

- interfaces.exclude in steward.yaml (names or shell patterns) leaves
  interfaces out of GET /interfaces, the web UI's picker and
  'steward interface list'. Subnets on them are still served.
- With the ping check on, active leases are pinged every minute; a
  client that answers gets a last-seen time (leases.last_seen,
  migration 4). Not answering never takes a client offline.
- The activity log filters by subnet (--subnet, the Activity page,
  GET /events?subnet=).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/e2e.sh

@@ -178,12 +178,24 @@ run "undo the lease time change" 0 S history undo $(S history list -o json | gre
 run "lease time back" 0 S subnet show iot
 contains "Lease time: *1h"
 
+# ---- last seen: a client that stays up answers pings
+
+# busybox's default script puts the leased address on the interface.
+docker run -d --name ${P}-live --network ${P}-b --mac-address 02:00:00:00:00:30 --cap-add NET_ADMIN steward-e2e-client \
+	udhcpc -i eth0 -f -x hostname:live >/dev/null
+for i in $(seq 1 20); do S lease list | grep -q " live " && break; sleep 0.5; done
+
 # ---- restart: leases survive
 
 docker exec ${P}-srv sh -c 'kill $(pidof stewardd)'; sleep 1
 run "restart stewardd" 0 start
 run "leases after the restart" 0 S lease list
 contains "$NA.101 *02:00:00:00:00:01 *laptop *active"
+# A ping round runs at start (then every minute).
+sleep 2
+run "last seen" 0 S lease list
+contains "live *active *in [0-9hm]* *now *eth1"
+contains "laptop *active *in [0-9hm]* *- *eth0"
 run "the client still gets its address" 0 udhcpc a 02:00:00:00:00:01
 contains "BOUND ip=$NA.101 "