fix(dhcp): read the Kea subnet record from subnet4, not subnet

getSubnet wraps its record under `subnet4`. The driver read `subnet`, got
nothing, and carried on:

  - get_dhcp_subnets() reported every subnet with no pools, no options and no
    description. Only the CIDR survived, and only because it falls back to the
    searchSubnet row. Confirmed against a live OPNsense serving six subnets:
    all six came back with empty pools while the device had
    "10.10.0.100-10.10.0.250" and routers/DNS/NTP set on each.

  - apply_dhcp_subnet() read the same key to merge the options it was not
    asked to change. An empty record means nothing to preserve, so updating a
    subnet with only domain_search set would have written back only that one
    option and blanked the routers Kea autocollected — stranding every client
    on that VLAN without a gateway. That is precisely the failure the merge
    exists to prevent.

The unit fixtures encoded the wrong shape, which is why the safety test
test_unnamed_options_are_preserved_on_update passed while the real thing was
broken. They now carry the response captured from OPNsense 25.x, and correcting
them turns that test red against the old parse.

Both call sites go through _kea_subnet_record(), which prefers `subnet4` and
falls back to `subnet` for older builds.

tests/unit/test_driver.py

@@ -2177,10 +2177,11 @@ KEA_SUBNET_SEARCH_RESPONSE = {
     ]
 }
 
-# getSubnet wraps the record and, unlike searchSubnet, carries the options.
-# OPNsense renders AsList fields as comma-separated strings.
+# getSubnet wraps the record under `subnet4` -- captured from OPNsense 25.x,
+# not guessed. Unlike searchSubnet it carries the options, and OPNsense
+# renders AsList fields as comma-separated strings.
 KEA_SUBNET_DETAIL_RESPONSE = {
-    "subnet": {
+    "subnet4": {
         "subnet": "10.10.20.0/24",
         "description": "Home",
         "pools": "10.10.20.100-10.10.20.200",
@@ -2243,7 +2244,7 @@ class TestGetDhcpSubnets:
 
     def test_multiline_pools_become_a_list(self, driver):
         detail = {
-            "subnet": {
+            "subnet4": {
                 "subnet": "10.10.20.0/24",
                 "description": "",
                 "pools": "10.10.20.100-10.10.20.150\n10.10.20.180-10.10.20.200",
@@ -2259,7 +2260,7 @@ class TestGetDhcpSubnets:
     def test_selection_map_shape_is_accepted(self, driver):
         """Some OPNsense versions render list fields as a selection map."""
         detail = {
-            "subnet": {
+            "subnet4": {
                 "subnet": "10.10.20.0/24",
                 "description": "",
                 "pools": "",
@@ -2400,3 +2401,21 @@ class TestCommitDhcpSubnets:
 
         assert driver.commit_dhcp_subnets() == {"success": True}
         assert calls == ["/api/kea/service/reconfigure"]
+
+
+class TestKeaSubnetRecordKey:
+    """`getSubnet` wraps its record under `subnet4`. Reading the wrong key is
+    not a cosmetic miss: the record comes back empty, so every subnet reports
+    no pools and no options, and the partial-option merge on update has
+    nothing to preserve."""
+
+    def test_reads_the_subnet4_wrapper(self, driver):
+        record = driver._kea_subnet_record({"subnet4": {"subnet": "10.0.0.0/24"}})
+        assert record == {"subnet": "10.0.0.0/24"}
+
+    def test_falls_back_to_the_legacy_subnet_wrapper(self, driver):
+        record = driver._kea_subnet_record({"subnet": {"subnet": "10.0.0.0/24"}})
+        assert record == {"subnet": "10.0.0.0/24"}
+
+    def test_unknown_shape_yields_an_empty_record(self, driver):
+        assert driver._kea_subnet_record({"something_else": {}}) == {}