Disable reservations; subnet enable/disable buttons; page-head CSS fix

- A disabled reservation is kept but ignored: the client gets a pool
  address like any other (steward reservation disable|enable, buttons and
  a checkbox in the web UI). Schema migration 3.
- Subnets get Disable/Enable buttons on their page and in the list.
- A rule left without its selector in style.css broke the page heading's
  layout, so the New ... buttons sat cramped under the description.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/pages/subnets.js

@@ -2,6 +2,7 @@
 import { h, mount, table, modal, errorBox, badge } from "../ui.js";
 import { get, change, can } from "../api.js";
 import { usageBar, subnetForm, fmtSeconds, subnetLabel } from "../widgets.js";
+import { toggleSubnet } from "./subnet.js";
 
 export async function render(el, params, query) {
   const subnets = await get("/subnets");
@@ -18,8 +19,9 @@ export async function render(el, params, query) {
       { label: "In use", render: (s) => usageBar(s.usage) },
       { label: "Reserved", class: "num", tdClass: "num", render: (s) => String(s.usage.reservations) },
       { label: "Lease time", render: (s) => s.lease_time ? fmtSeconds(s.lease_time) : h("span", { class: "muted" }, "default") },
-      { label: "", render: (s) => s.disabled ? badge("disabled", "off") : null },
-    ], subnets, { empty: "No subnets yet. Add one for each network Steward should serve." })));
+      { label: "", tdClass: "actions-cell", render: (s) => [s.disabled ? [badge("disabled", "off"), " "] : null,
+        can("config", true) ? h("button", { class: "small reveal", onclick: () => toggleSubnet(s) }, s.disabled ? "Enable" : "Disable") : null] },
+    ], subnets, { empty: "No subnets yet. Add one for each network Steward should serve.", rowClass: (s) => s.disabled ? "disabled" : "" })));
   if (query.get("new") === "1" && can("config", true)) newSubnet();
 }