Disable reservations; subnet enable/disable buttons; page-head CSS fix

- A disabled reservation is kept but ignored: the client gets a pool
  address like any other (steward reservation disable|enable, buttons and
  a checkbox in the web UI). Schema migration 3.
- Subnets get Disable/Enable buttons on their page and in the list.
- A rule left without its selector in style.css broke the page heading's
  layout, so the New ... buttons sat cramped under the description.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/pages/subnet.js

@@ -21,7 +21,11 @@ export async function render(el, params) {
         h("div", { class: "muted" }, "On ", h("span", { class: "mono" }, s.interface), " · pools ",
           s.pools.length ? h("span", { class: "mono" }, s.pools.map((p) => p.start + "-" + p.end).join(", ")) : "none",
           " · lease time ", s.lease_time ? fmtSeconds(s.lease_time) : "the default")),
-      h("div", { class: "subnet-usage" }, usageBar(s.usage))),
+      h("div", { class: "subnet-usage" }, usageBar(s.usage)),
+      can("config", true) ? h("div", { class: "actions" }, h("button", {
+        title: s.disabled ? "Answer this subnet's clients again" : "Stop answering this subnet's clients; its configuration and leases stay",
+        onclick: () => toggleSubnet(s) }, s.disabled ? "Enable subnet" : "Disable subnet")) : null),
+    s.disabled ? h("div", { class: "msg warn" }, "This subnet is disabled: its clients get no answers. Its configuration and leases are kept.") : null,
     h("div", { class: "tabs" }, tabs.map(([k, label]) => h("a", { href: "#/subnets/" + id + "/" + k, class: tab === k ? "active" : "" }, label))),
     body);
   if (tab === "leases") await leasesTab(body, s);
@@ -29,6 +33,14 @@ export async function render(el, params) {
   else await settingsTab(body, s);
 }
 
+export async function toggleSubnet(s) {
+  if (!s.disabled && !await confirmDialog("Disable subnet", "Stop answering the clients of " + subnetLabel(s) + "? They keep their addresses until their leases run out, then have none. The configuration and leases stay; Enable brings it back.", "Disable", "danger")) return;
+  try {
+    await change("PATCH", "/subnets/" + s.id, { disabled: !s.disabled });
+    rerender();
+  } catch (e) { modal(s.disabled ? "Not enabled" : "Not disabled", errorBox(e)); }
+}
+
 async function leasesTab(el, s) {
   const search = input({ type: "search", placeholder: "address, MAC or host name" });
   const out = h("div");