feat(proto/steam): M3 — rich Steam wire (back buttons + 2nd trackpad)

Carry the rich Steam Controller / Steam Deck inputs end-to-end on the wire —
strictly additive + forward-compatible (unknown kinds/bits drop on old peers).

Core (punktfunk-core):
- input.rs: BTN_PADDLE1..4 + BTN_MISC1 in Moonlight's buttonFlags2<<16 namespace
  (so the GameStream paddle path and native grips share one host injector map;
  Steam L4/L5/R4/R5 reuse the four Xbox-Elite paddle slots).
- quic.rs: RichInput::TouchpadEx (kind 0x03 — surface 0/1/2, touch+click, signed
  coords, pressure; the second trackpad the single Touchpad can't express) and
  HidOutput::TrackpadHaptic (kind 0x04 — the SC voice-coil pulse). Round-tripped.
- abi.rs: PUNKTFUNK_GAMEPAD_STEAMDECK=6 / _STEAMCONTROLLER=5, the paddle bits,
  RICH_TOUCHPAD_EX / HIDOUT_TRACKPAD_HAPTIC constants. from_hid packs
  TrackpadHaptic into the existing which + effect[0..6] — the legacy structs do
  NOT grow (guarded by new size_of==20/19 asserts); GamepadPref lockstep +
  paddle-bit lockstep asserts extended. include/punktfunk_core.h regenerated.

Host (punktfunk-host):
- steam_proto::from_gamepad maps the wire paddles -> the four Deck grips + QAM;
  apply_rich routes TouchpadEx left/right -> the matching pad.
- every DualSense/DS4 manager (Linux + Windows) gained a TouchpadEx arm
  (surface 0/2 -> its one touchpad; surface 1 ignored) so the variant compiles
  everywhere and a Steam client streaming to a DS host keeps its right pad.
- the xpad BUTTON_MAP finally consumes the GameStream paddle bits
  (BTN_TRIGGER_HAPPY5-8) — Sunshine/Moonlight paddle clients were silently
  no-op'd before (design §5.6).
- Android feedback: drop TrackpadHaptic (no coils; rumble rides 0xCA).

Validated on-box: the ignored backend test now drives the full wire path —
from_gamepad (BTN_A + the L4 grip) + apply_rich (a left-pad TouchpadEx) reach the
evdev as BTN_A + ABS_HAT0X=-8000. Wire round-trips + paddle/TouchpadEx mapping
unit-tested. Workspace clippy/fmt/test green. Not pushed.

Deferred to M4: the C-ABI PunktfunkRichInputEx + send_rich_input2 (only the
Apple/embedder *send* path needs it; the host decodes TouchpadEx today).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

include/punktfunk_core.h

@@ -28,6 +28,11 @@
 // `PunktfunkHidOutput::kind` — one adaptive-trigger effect (`which` + `effect`/`effect_len` valid).
 #define PUNKTFUNK_HIDOUT_TRIGGER 3
 
+// `PunktfunkHidOutput::kind` — a trackpad haptic pulse (Steam Controller voice-coils). `which` =
+// side (0 = right pad, 1 = left pad); `effect[0..6]` packs `amplitude` / `period` / `count` as
+// little-endian `u16`s with `effect_len = 6`. Clients without trackpad coils drop it.
+#define PUNKTFUNK_HIDOUT_TRACKPAD_HAPTIC 4
+
 // Capacity of `PunktfunkHidOutput::effect` (the DualSense trigger parameter block).
 #define PUNKTFUNK_HID_EFFECT_MAX 11
 
@@ -37,6 +42,12 @@
 // `PunktfunkRichInput::kind` — a motion sample (`gyro`/`accel` valid).
 #define PUNKTFUNK_RICH_MOTION 2
 
+// `RichInput::TouchpadEx` kind on the wire — an extended trackpad contact that identifies the
+// surface (0 single / 1 Steam-left / 2 Steam-right) and carries click + pressure. The host decodes
+// it today; *sending* it from a C client needs the size-prefixed `PunktfunkRichInputEx` +
+// `punktfunk_connection_send_rich_input2` (added with client capture).
+#define PUNKTFUNK_RICH_TOUCHPAD_EX 3
+
 // Compositor preference for [`punktfunk_connect_ex`] (`compositor` arg). `AUTO` lets the host
 // pick (auto-detect from its running desktop); a concrete value is honored only if that backend
 // is available on the host right now, else the host falls back to auto-detect. The resolved
@@ -82,6 +93,28 @@
 // hosts); otherwise the host falls back to X-Box 360.
 #define PUNKTFUNK_GAMEPAD_DUALSHOCK4 4
 
+// UHID classic Steam Controller (Valve `28DE:1102`, kernel `hid-steam`): dual trackpads, gyro,
+// two grip paddles. Reserved — currently folds to `XBOX360` until its backend lands.
+#define PUNKTFUNK_GAMEPAD_STEAMCONTROLLER 5
+
+// UHID Steam Deck controller (Valve `28DE:1205`, kernel `hid-steam`): full Deck gamepad incl. the
+// four back grips, a right trackpad, and the IMU; re-grabbed by Steam Input with native glyphs when
+// Steam runs on the host. Honored only where available (Linux hosts); else folds to X-Box 360.
+#define PUNKTFUNK_GAMEPAD_STEAMDECK 6
+
+// Extended `InputEvent` gamepad button bits for embedders building raw events: the four back grips
+// (Steam L4/L5/R4/R5 ≙ Xbox-Elite P1–P4) + the misc/capture button, in Moonlight's
+// `buttonFlags2 << 16` namespace. Mirror `input::gamepad::BTN_PADDLE1..4` / `BTN_MISC1`.
+#define PUNKTFUNK_GAMEPAD_BTN_PADDLE1 65536
+
+#define PUNKTFUNK_GAMEPAD_BTN_PADDLE2 131072
+
+#define PUNKTFUNK_GAMEPAD_BTN_PADDLE3 262144
+
+#define PUNKTFUNK_GAMEPAD_BTN_PADDLE4 524288
+
+#define PUNKTFUNK_GAMEPAD_BTN_MISC1 2097152
+
 // Connect to a `punktfunk/1` host and start a session at `width`x`height`@`refresh_hz`.
 // Blocks up to `timeout_ms` for the handshake. Returns NULL on failure. Equivalent to
 // [`punktfunk_connect_ex`] with `compositor = PUNKTFUNK_COMPOSITOR_AUTO`.
@@ -139,11 +172,26 @@
 
 #define PUNKTFUNK_BTN_Y 32768
 
+// Back grip R4 — SDL `RightPaddle1` / GameStream `PADDLE1`.
+#define BTN_PADDLE1 65536
+
+// Back grip L4 — SDL `LeftPaddle1` / GameStream `PADDLE2`.
+#define BTN_PADDLE2 131072
+
+// Back grip R5 — SDL `RightPaddle2` / GameStream `PADDLE3`.
+#define BTN_PADDLE3 262144
+
+// Back grip L5 — SDL `LeftPaddle2` / GameStream `PADDLE4`.
+#define BTN_PADDLE4 524288
+
 // DualSense touchpad click. Moonlight's extended-button position (`buttonFlags2`
 // merges in at `<< 16`, see `gamestream/gamepad.rs`), so GameStream clients land on
 // the same bit. Only the DualSense backend renders it; the xpad has no such button.
 #define PUNKTFUNK_BTN_TOUCHPAD 1048576
 
+// Misc / capture button — the Deck `…`/quick-access, Share/Capture / GameStream `MISC`.
+#define BTN_MISC1 2097152
+
 // Axis ids for `InputKind::GamepadAxis`.
 #define PUNKTFUNK_AXIS_LS_X 0