Disable reservations; subnet enable/disable buttons; page-head CSS fix

- A disabled reservation is kept but ignored: the client gets a pool
  address like any other (steward reservation disable|enable, buttons and
  a checkbox in the web UI). Schema migration 3.
- Subnets get Disable/Enable buttons on their page and in the list.
- A rule left without its selector in style.css broke the page heading's
  layout, so the New ... buttons sat cramped under the description.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/dhcpd/config.go

@@ -52,6 +52,9 @@ func compile(st *model.State) *config {
 		c.byIface[s.Interface] = append(c.byIface[s.Interface], sc)
 	}
 	for _, r := range st.Reservations {
+		if r.Disabled {
+			continue
+		}
 		c.resByIP[r.IP] = r
 		s := st.SubnetFor(r.IP)
 		if s == nil {

internal/dhcpd/handle_test.go

@@ -444,3 +444,20 @@ func TestPrune(t *testing.T) {
 		t.Errorf("old lease still saved: %+v", ls)
 	}
 }
+
+func TestDisabledReservation(t *testing.T) {
+	// The printer's reservation (10.0.10.101, inside the pool) is
+	// disabled: the printer gets a pool address like anyone, and its
+	// reserved address can go to others.
+	h := newHarness(t, func(st *model.State) { st.Reservations[1].Disabled = true })
+	got := map[string]bool{}
+	for i := byte(1); i <= 4; i++ {
+		got[h.lease("eth0", mac(i)).YIAddr.String()] = true
+	}
+	if !got["10.0.10.101"] {
+		t.Errorf("the disabled reservation's address wasn't handed out: %v", got)
+	}
+	if out := h.discover("eth0", mac(0x98)); out != nil {
+		t.Errorf("the printer got %s from a full pool", out.Packet.YIAddr)
+	}
+}