feat(gamepad): controller discovery + client-negotiated pad type + rich DualSense end to end

The Apple client grows full gamepad support and punktfunk/1 learns to negotiate
the virtual pad type:

- Protocol: Hello carries a GamepadPref byte (offset 21, the same trailing-byte
  back-compat pattern as the compositor; echoed resolved in Welcome at 54).
  Host precedence: explicit client choice > PUNKTFUNK_GAMEPAD env > Xbox 360,
  DualSense (UHID) only where available. ABI: punktfunk_connect_ex2 +
  punktfunk_connection_gamepad (connect_ex delegates; ABI_VERSION stays 2 — the
  trailing byte IS the compat mechanism). punktfunk-client-rs gets --gamepad.

- Swift client: GamepadManager (app-lifetime discovery + selection — Settings
  lists every controller with capabilities/battery/"In use"; exactly ONE pad
  forwards as pad 0, auto = most recently connected, or pinned), GamepadCapture
  (snapshot-diff button/axis events, DualSense touchpad + ~250 Hz motion on the
  rich-input plane, held state released on switch/deactivate/stop),
  GamepadFeedback (rumble → CoreHaptics per-handle engines; lightbar →
  GCDeviceLight; player LEDs → playerIndex; adaptive-trigger blocks → the
  table-driven DualSenseTriggerEffect parser → GCDualSenseAdaptiveTrigger,
  exact for the 10-zone positional modes). The pad type auto-resolves from the
  physical controller at connect time, user-overridable in Settings.

- Host DualSense fixes surfaced by adversarial review against hid-playstation /
  SDL / Nielk1 ground truth: input-report sensor/touch offsets were off by one
  (the kernel read garbage motion + phantom touches), the L2/R2 trigger blocks
  were swapped (the report is right-trigger-first), feedback now gates on the
  report's valid-flags (a plain rumble write no longer blanks lightbar/
  triggers), and the touchpad rescale clamps to the advertised ABS_MT extents.

- Tests: Hello/Welcome trailing-byte back-compat, pick_gamepad precedence,
  byte-exact input-report layout, valid-flag gating, per-mode trigger-parser
  table (incl. packed 3-bit zones), wire conversions, and a scripted loopback
  feedback burst (PUNKTFUNK_TEST_FEEDBACK=1) asserted through the xcframework
  on the rumble + HID-output planes.

Validated: cargo test/clippy/fmt green on macOS + Linux (61 host tests), swift
build/test green, test-loopback.sh green, tvOS/iOS targets compile. DualSense
motion sign/scale is derived from the calibration blob, not yet live-verified
(constants isolated in GamepadWire).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

clients/apple/Sources/PunktfunkClient/SessionModel.swift

@@ -60,11 +60,14 @@ final class SessionModel: ObservableObject {
     let meter = FrameMeter()
     private var statsTimer: Timer?
     private var audio: SessionAudio?
+    private var gamepadCapture: GamepadCapture?
+    private var gamepadFeedback: GamepadFeedback?
 
     var isBusy: Bool { phase != .idle }
 
     func connect(to host: StoredHost, width: UInt32, height: UInt32, hz: UInt32,
                  compositor: PunktfunkConnection.Compositor = .auto,
+                 gamepad: PunktfunkConnection.GamepadType = .auto,
                  autoTrust: Bool = false) {
         guard phase == .idle else { return }
         phase = .connecting
@@ -80,7 +83,8 @@ final class SessionModel: ObservableObject {
             let result = Result { try PunktfunkConnection(
                 host: host.address, port: host.port,
                 width: width, height: height, refreshHz: hz,
-                pinSHA256: pin, identity: identity, compositor: compositor) }
+                pinSHA256: pin, identity: identity, compositor: compositor,
+                gamepad: gamepad) }
             await MainActor.run { [weak self] in
                 guard let self else { return }
                 // The user may have abandoned this attempt (window closed, another host
@@ -135,16 +139,26 @@ final class SessionModel: ObservableObject {
         statsTimer = nil
         let audio = self.audio
         self.audio = nil
+        // Gamepad capture is main-actor (releases held buttons on the wire while the
+        // connection is still up); the feedback drain joins off-main like audio.
+        gamepadCapture?.stop()
+        gamepadCapture = nil
+        let feedback = gamepadFeedback
+        gamepadFeedback = nil
         if let conn = connection {
-            // Audio teardown waits its drain thread out and close() waits out in-flight
-            // polls + joins the Rust worker threads — keep both off the main actor, in
-            // this order (no audio poll left when the handle is freed).
+            // Drain-thread teardown waits the pullers out and close() waits out in-flight
+            // polls + joins the Rust worker threads — keep all of it off the main actor,
+            // in this order (no poll left on any plane when the handle is freed).
             Task.detached {
                 audio?.stop()
+                feedback?.stop()
                 conn.close()
             }
         } else {
-            Task.detached { audio?.stop() }
+            Task.detached {
+                audio?.stop()
+                feedback?.stop()
+            }
         }
         connection = nil
         activeHost = nil
@@ -177,6 +191,16 @@ final class SessionModel: ObservableObject {
             micUID: defaults.string(forKey: "punktfunk.micUID") ?? "",
             micEnabled: defaults.object(forKey: "punktfunk.micEnabled") as? Bool ?? true)
         self.audio = audio
+        // Gamepads: forward GamepadManager's active controller as pad 0 and render the
+        // host's feedback (rumble always; lightbar/player-LEDs/adaptive-triggers when the
+        // session's virtual pad is a DualSense). Same trust gate as audio — nothing is
+        // forwarded during the trust prompt.
+        let capture = GamepadCapture(connection: conn, manager: .shared)
+        capture.start()
+        gamepadCapture = capture
+        let feedback = GamepadFeedback(connection: conn, manager: .shared)
+        feedback.start()
+        gamepadFeedback = feedback
     }
 
     private func startStatsTimer() {