Disable reservations; subnet enable/disable buttons; page-head CSS fix

- A disabled reservation is kept but ignored: the client gets a pool
  address like any other (steward reservation disable|enable, buttons and
  a checkbox in the web UI). Schema migration 3.
- Subnets get Disable/Enable buttons on their page and in the list.
- A rule left without its selector in style.css broke the page heading's
  layout, so the New ... buttons sat cramped under the description.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/validate/validate.go

@@ -275,18 +275,22 @@ func (c *checker) reservations(st *model.State, env *Env) {
 		if r.IP == s.Prefix.Addr() || r.IP == model.Last(s.Prefix) {
 			c.add(Error, "reservation_network_address", obj, "%s is the network or broadcast address of %s", r.IP, s.Prefix)
 		}
-		if o := byIP[r.IP]; o != nil {
-			c.add(Error, "reservation_ip_taken", obj, "%s is already reserved for %s", r.IP, o.Label())
+		// A disabled reservation is ignored, so it takes no address or
+		// client from another; enabling it again is checked.
+		if !r.Disabled {
+			if o := byIP[r.IP]; o != nil {
+				c.add(Error, "reservation_ip_taken", obj, "%s is already reserved for %s", r.IP, o.Label())
+			}
+			byIP[r.IP] = r
+			k := key{s.ID, "mac " + r.MAC}
+			if r.ClientID != "" {
+				k.id = "id " + r.ClientID
+			}
+			if o := byClient[k]; o != nil {
+				c.add(Error, "reservation_client_taken", obj, "this client already has a reservation in %s: %s", s.Label(), o.Label())
+			}
+			byClient[k] = r
 		}
-		byIP[r.IP] = r
-		k := key{s.ID, "mac " + r.MAC}
-		if r.ClientID != "" {
-			k.id = "id " + r.ClientID
-		}
-		if o := byClient[k]; o != nil {
-			c.add(Error, "reservation_client_taken", obj, "this client already has a reservation in %s: %s", s.Label(), o.Label())
-		}
-		byClient[k] = r
 		if r.Hostname != "" && !validHostname(r.Hostname) {
 			c.add(Error, "reservation_hostname", obj, "%q isn't a valid host name (letters, digits and '-', labels up to 63 characters, separated by dots)", r.Hostname)
 		}