Address order: sequential, reverse or random, per subnet and pool

- Which never-used pool address a new client gets: sequential (the
  lowest, as before), reverse or random, in the settings, a subnet or
  a single pool (FIRST-LAST:ORDER). When no never-used address is left,
  the one free the longest, whatever the order; returning clients keep
  theirs.
- A subnet's pools are used in the order listed, or one at random
  weighted by its never-used addresses. Pools now keep the order they
  are given in (no more sorting by address).
- CLI --address-order and --pool-order; --add-pool of an existing range
  changes its order in place. Web UI: per-pool order and a move-up
  button, pool and address order on the subnet and settings pages.
- Kea's allocator: random is imported. Schema migration 5.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/subnets.md

@@ -121,8 +121,9 @@ For a DISCOVER, Steward offers, in this order:
    ended, as long as it is still free and in a pool;
 3. the address the client asks for (option 50), if it is free and in a
    pool;
-4. a free pool address: one never handed out before, else the one that has
-   been free the longest.
+4. a free pool address: one never handed out before, in the subnet's
+   [address order](#address-order), else the one that has been free the
+   longest.
 
 An address is free when no other client has an active lease on it, it
 isn't held back, and it isn't offered to someone else in the last minute.
@@ -133,6 +134,40 @@ tried.
 When the client confirms with a REQUEST, the lease is saved, and only
 then is the ACK sent.
 
+## Address order
+
+Which never-used address a new client gets is set at three levels, each
+overriding the one above:
+
+| Level | Setting | Values |
+|---|---|---|
+| settings | `steward settings set --address-order` | `sequential` (the lowest free address, the default), `reverse` (the highest), `random` |
+| subnet | `--address-order` | the same, or `default` (the settings') |
+| pool | `:ORDER` after the pool: `--pool 10.0.10.200-10.0.10.250:random` | the same, or `default` (the subnet's) |
+
+A subnet with several pools also has a **pool order**, `--pool-order`:
+
+* `listed` (the default): the pools are used in the order they are
+  listed; the next one only when the one before has no never-used address
+  left. `--pool` gives the order; in the web UI, ↑ moves a pool up.
+* `random`: a pool at random, weighted by how many never-used addresses
+  each has, so addresses spread over all of them. With `random` addresses
+  too, every never-used address in the subnet is as likely as any other.
+
+```
+steward subnet update office --pool-order random --address-order reverse
+steward subnet update office --add-pool 10.0.10.200-10.0.10.250:random   # one pool's own order
+steward subnet update office --add-pool 10.0.10.200-10.0.10.250:default  # back to the subnet's
+```
+
+The order only picks among addresses **never handed out** (or whose lease
+was deleted, or ended over 30 days ago). Once every free address has been
+used before, the one free the longest is given, whatever the order: an
+address that just came free isn't handed to the next device, so stale ARP
+caches and DNS records don't point at the wrong one. Returning clients
+keep their address (steps 2 and 3), so changing the order doesn't move
+anyone.
+
 ## Leases
 
 | State | Meaning |