Disable reservations; subnet enable/disable buttons; page-head CSS fix

- A disabled reservation is kept but ignored: the client gets a pool
  address like any other (steward reservation disable|enable, buttons and
  a checkbox in the web UI). Schema migration 3.
- Subnets get Disable/Enable buttons on their page and in the list.
- A rule left without its selector in style.css broke the page heading's
  layout, so the New ... buttons sat cramped under the description.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/api.md

@@ -102,7 +102,7 @@ settings'.
 | | |
 |---|---|
 | `GET /reservations[?subnet=REF]` | each with `subnet_id`, `subnet` and its current `lease` |
-| `POST /reservations` | `{"ip", "mac", "client_id", "hostname", "options", "comment"}`; `ip` and `mac` or `client_id` needed |
+| `POST /reservations` | `{"ip", "mac", "client_id", "hostname", "options", "disabled", "comment"}`; `ip` and `mac` or `client_id` needed |
 | `GET`, `PATCH`, `DELETE /reservations/{ref}` | by ID, address, or MAC address (when it has one reservation) |
 
 ### Leases and activity

docs/cli.md

@@ -79,6 +79,7 @@ one. An option Steward doesn't know: `--option 224:string=hello`.
 | `reservation show RES` | RES is its ID, address or MAC address |
 | `reservation add IP MAC [--hostname H] [--client-id HEX] [--option NAME=VALUE]... [--comment C]` | `-` for MAC with `--client-id` |
 | `reservation update RES [--ip] [--mac] [--client-id] [--hostname] [--option]... [--unset-option]... [--comment]` | |
+| `reservation enable\|disable RES` | use a reservation, or keep it but ignore it |
 | `reservation delete RES` | |
 
 ### lease

docs/subnets.md

@@ -34,7 +34,8 @@ answered from the interface's address in their own subnet, or its first
 address.
 
 A subnet can be **disabled**: its configuration and leases stay, but its
-clients get no answers (`steward subnet disable NAME`).
+clients get no answers (`steward subnet disable NAME`, or Disable in the
+web UI).
 
 ## Pools
 
@@ -67,6 +68,14 @@ steward lease reserve 10.0.10.57       # the address a client has now
 * **A device on two VLANs** can have a reservation in each subnet. Within
   one subnet, a client has at most one.
 
+A reservation can be **disabled** (`steward reservation disable RES`, or
+Disable in the web UI). It is kept but ignored: the client gets a pool
+address like any other, and the reserved address, if it is inside a pool,
+may go to someone else. The client keeps the address it has until its
+lease runs out. While it is disabled, another reservation may use its
+address or client; enabling it again is then refused until one of them
+moves.
+
 A client with a reservation always gets that address, not a pool address.
 If it asks for another one, for example after the reservation was added,
 it gets a NAK that names its reserved address, and then the reservation.