Disable reservations; subnet enable/disable buttons; page-head CSS fix

- A disabled reservation is kept but ignored: the client gets a pool
  address like any other (steward reservation disable|enable, buttons and
  a checkbox in the web UI). Schema migration 3.
- Subnets get Disable/Enable buttons on their page and in the list.
- A rule left without its selector in style.css broke the page heading's
  layout, so the New ... buttons sat cramped under the description.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -102,6 +102,9 @@ and a CLI, built the way Jarl is.
 - **HTTPS and plain HTTP on one port:** with a certificate, plain HTTP is
   redirected to HTTPS, except from the server itself (also for
   `tls.cert_file`).
+- **Disabled reservations** (`steward reservation disable|enable`, Disable
+  in the web UI): kept but ignored, so the client gets a pool address like
+  any other. Subnets get Disable/Enable buttons in the web UI too.
 - **Token rotation** (`steward token rotate`, `POST /tokens/{id}/rotate`,
   Rotate in the web UI): a new secret for a token, with an optional grace
   period for the old one, as in Jarl.