feat: mic passthrough — client microphone → host virtual PipeWire source

The inverse of the host→client audio path: the client's mic, Opus-encoded, rides a
new 0xCB QUIC datagram to the host, which decodes it into a virtual PipeWire
Audio/Source its apps can record from (voice chat, etc.).

Protocol (punktfunk-core):
- MIC_MAGIC 0xCB + encode/decode_mic_datagram (mirror of the 0xC9 audio datagram).
- NativeClient::send_mic(seq, pts_ns, opus) over a new outbound channel + worker task
  (mirror of send_input); C ABI punktfunk_connection_send_mic for native clients.

Host:
- audio::VirtualMic + PwMicSource: a PipeWire output stream tagged media.class=
  Audio/Source (Direction::Output) — a recordable microphone node, fed decoded PCM.
- MicService: host-lifetime owner of the source + Opus decoder (mirror of
  InjectorService / the audio capturer slot); lazily opened, persists across sessions,
  self-heals. The per-session datagram reader now demuxes 0xCB→mic / 0xC8→input over a
  single read_datagram loop (two loops would race).
- Adaptive jitter buffer in the producer: primes to ~3 consumer quanta before emitting,
  so the 5 ms push / N ms pull clock skew never underruns — without it ~58% of output
  was silence; with it, glitch-free across consumer quanta.

Client: punktfunk-client-rs --mic-test streams a synthetic 440 Hz Opus tone as the mic
uplink (opus dep added) for end-to-end validation without a real microphone.

Validated live on headless KWin: client tone → host source → pw-record shows the
punktfunk-mic Audio/Source node, 440 Hz dominant (Goertzel power 20.7 vs <0.001
elsewhere), RMS 0.179 ≈ the ideal 0.177, 0.3–0.4% silence at both 256 ms and 10 ms
consumer quanta. Tests +1 (mic datagram roundtrip); workspace green, clippy/fmt clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

include/punktfunk_core.h

@@ -135,8 +135,9 @@
 
 #if defined(PUNKTFUNK_FEATURE_QUIC)
 // Datagram wire tags. Video rides UDP; everything low-rate rides QUIC datagrams,
-// demultiplexed by the first byte: input = [`crate::input::INPUT_MAGIC`] (0xC8),
-// audio = [`AUDIO_MAGIC`], rumble = [`RUMBLE_MAGIC`].
+// demultiplexed by the first byte: input = [`crate::input::INPUT_MAGIC`] (0xC8, client→host),
+// audio = [`AUDIO_MAGIC`] (0xC9, host→client), rumble = [`RUMBLE_MAGIC`] (0xCA, host→client),
+// mic = [`MIC_MAGIC`] (0xCB, client→host).
 #define PUNKTFUNK_AUDIO_MAGIC 201
 #endif
 
@@ -144,6 +145,12 @@
 #define PUNKTFUNK_RUMBLE_MAGIC 202
 #endif
 
+#if defined(PUNKTFUNK_FEATURE_QUIC)
+// Microphone uplink: the client's mic, Opus-encoded, client → host (the inverse of
+// [`AUDIO_MAGIC`]). The host feeds it into a virtual PipeWire source so its apps can record it.
+#define MIC_MAGIC 203
+#endif
+
 // Stable C ABI status codes. `Ok` is 0; all errors are negative so callers can
 // test `rc < 0`. Do not renumber existing variants — only append.
 enum PunktfunkStatus
@@ -507,6 +514,21 @@ PunktfunkStatus punktfunk_connection_send_input(PunktfunkConnection *c,
                                                 const PunktfunkInputEvent *ev);
 #endif
 
+#if defined(PUNKTFUNK_FEATURE_QUIC)
+// Send one Opus mic frame to the host as a QUIC datagram (48 kHz; the host decodes it into a
+// virtual microphone source its apps can record). Non-blocking enqueue; the host uses `seq`/
+// `pts_ns` (the caller's own counters) only for diagnostics. `opus_data`/`len` may be empty
+// (a DTX silence frame). The data is copied; the caller may reuse the buffer after this returns.
+//
+// # Safety
+// `c` is a valid connection handle; `opus_data` is valid for `len` bytes (or `len == 0`).
+PunktfunkStatus punktfunk_connection_send_mic(PunktfunkConnection *c,
+                                              const uint8_t *opus_data,
+                                              uintptr_t len,
+                                              uint32_t seq,
+                                              uint64_t pts_ns);
+#endif
+
 #if defined(PUNKTFUNK_FEATURE_QUIC)
 // The currently active session mode — the Welcome's, until an accepted
 // [`punktfunk_connection_request_mode`] switches it. Safe any time after connect.