Disable reservations; subnet enable/disable buttons; page-head CSS fix

- A disabled reservation is kept but ignored: the client gets a pool
  address like any other (steward reservation disable|enable, buttons and
  a checkbox in the web UI). Schema migration 3.
- Subnets get Disable/Enable buttons on their page and in the list.
- A rule left without its selector in style.css broke the page heading's
  layout, so the New ... buttons sat cramped under the description.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/subnets.md

@@ -34,7 +34,8 @@ answered from the interface's address in their own subnet, or its first
 address.
 
 A subnet can be **disabled**: its configuration and leases stay, but its
-clients get no answers (`steward subnet disable NAME`).
+clients get no answers (`steward subnet disable NAME`, or Disable in the
+web UI).
 
 ## Pools
 
@@ -67,6 +68,14 @@ steward lease reserve 10.0.10.57       # the address a client has now
 * **A device on two VLANs** can have a reservation in each subnet. Within
   one subnet, a client has at most one.
 
+A reservation can be **disabled** (`steward reservation disable RES`, or
+Disable in the web UI). It is kept but ignored: the client gets a pool
+address like any other, and the reserved address, if it is inside a pool,
+may go to someone else. The client keeps the address it has until its
+lease runs out. While it is disabled, another reservation may use its
+address or client; enabling it again is then refused until one of them
+moves.
+
 A client with a reservation always gets that address, not a pool address.
 If it asks for another one, for example after the reservation was added,
 it gets a NAK that names its reserved address, and then the reservation.