feat(core,host,android): Steam Controller 2 as-is passthrough to Linux hosts

The 2026 Steam Controller (Valve "Ibex" / SDL "Triton") captured on an
Android client is passed through AS-IS: the host presents a virtual pad
with the real wired identity (28DE:1302) and mirrors the physical pad's
raw HID reports, so Steam on the host drives it over hidraw exactly like
the real thing — trackpads, gyro, paddles, and its rumble/settings writes
flow back onto the physical controller. Protocol ground truth: SDL's
Valve-maintained SDL_hidapi_steam_triton.c + steam/controller_structs.h.

Core:
- GamepadPref::SteamController2 (wire byte 9; names steamcontroller2/
  sc2/ibex) + PUNKTFUNK_GAMEPAD_STEAMCONTROLLER2 in the C ABI.
- Raw HID planes: RichInput::HidReport (0xCC/0x04, client→host input
  reports verbatim, Copy fixed-64 body) and HidOutput::HidRaw (0xCD/0x05,
  host→client feature/output writes for replay). Best-effort is sound by
  the device protocol's own design (rumble re-sent every ~40 ms, settings
  every ~3 s — losses self-heal); HidRaw bypasses hidout dedup for
  exactly that reason.

Host (Linux):
- triton_proto.rs + steam_controller2.rs: Triton2Manager UHID backend —
  no kernel driver binds the PID (hidraw only; Steam Input is the
  consumer), raw mirroring with a typed-fallback 0x42 synthesizer until
  the first raw report, SET_REPORT ack + raw forward, canned GET_REPORT
  serial reply, rumble also parsed onto the universal 0xCA plane (phone
  mirror). Rides the uhid + 28DE-conflict degrades; UHID promotion by
  Steam is flagged in the creation log (usbip transport is the known
  follow-up if Steam ignores Interface:-1 devices for Triton too).

Android:
- Sc2UsbLink (wired/Puck: vendor-interface claim detaches the OS driver,
  interrupt read loop, lizard-off on the watchdog cadence, raw replay via
  interrupt-OUT / SET_REPORT with hidapi report-id framing) and Sc2BleLink
  (Valve vendor GATT service, notify subscribe machine, 0x45 re-framing,
  HIGH connection priority).
- Sc2Capture orchestrator: raw plane + typed mirror (exit chord + host
  degrade paths keep working) on a GamepadRouter external slot; raw
  return path via GamepadFeedback.onHidRaw.
- nativeSendPadHidReport JNI (direct ByteBuffer, no per-report copy),
  hidout raw decode, usb-host/BLUETOOTH_CONNECT manifest bits, opt-out
  settings toggle, StreamScreen engagement incl. the USB permission flow.

Verified: core 149 + host 312 tests green on Linux (.21), on-box uhid
smoke creates/mirrors/tears down the virtual 28DE:1302, C ABI harness
round-trips, Android compileDebugKotlin green. On-glass with the real
controller owed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

clients/android/native/src/feedback.rs

@@ -22,6 +22,7 @@ const PULL_TIMEOUT: Duration = Duration::from_millis(100);
 const TAG_LED: u8 = 0x01;
 const TAG_PLAYER_LEDS: u8 = 0x02;
 const TAG_TRIGGER: u8 = 0x03;
+const TAG_HID_RAW: u8 = 0x05;
 
 /// `NativeBridge.nativeNextRumble(handle): Long` — block up to ~100 ms for the next rumble update.
 /// Returns a packed positive long: bits 49..52 = wire `pad` index (0..15), bit 48 = "has a v2 lease",
@@ -143,6 +144,20 @@ pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeNextHidout(
                 // rumble already rides the universal 0xCA plane).
                 return -1;
             }
+            HidOutput::HidRaw { pad, kind, data } => {
+                // As-is SC2 passthrough: the host's hidraw consumer (Steam) wrote this report to
+                // the virtual pad; Kotlin replays it verbatim on the physical controller.
+                // `[pad][0x05][kind][report…]` — kind 0 = output report, 1 = feature report.
+                let n = 3 + data.len();
+                if cap < n {
+                    return -1; // reports are ≤ 64 bytes; Kotlin allocates 128
+                }
+                out[0] = pad;
+                out[1] = TAG_HID_RAW;
+                out[2] = kind;
+                out[3..n].copy_from_slice(&data);
+                n
+            }
         };
         n as jint
     })

clients/android/native/src/session/input.rs

@@ -6,10 +6,11 @@
 //! conventions: buttons 1=left/2=middle/3=right/4=X1/5=X2; scroll axis 0=vertical/1=horizontal,
 //! signed 120-unit delta, +=up/right; keys are Windows VK (mapped from KEYCODE_* on the Kotlin side).
 
-use jni::objects::JObject;
+use jni::objects::{JByteBuffer, JObject};
 use jni::sys::{jboolean, jint, jlong};
 use jni::JNIEnv;
 use punktfunk_core::input::{InputEvent, InputKind};
+use punktfunk_core::quic::{RichInput, HID_REPORT_MAX};
 
 use super::SessionHandle;
 
@@ -236,3 +237,43 @@ pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeSendGamepad
 ) {
     send_event(handle, InputKind::GamepadRemove, 0, 0, 0, pad as u32);
 }
+
+/// `NativeBridge.nativeSendPadHidReport(handle, pad, buf, len)` — one raw HID input report from a
+/// client-captured controller (the as-is Steam Controller 2 passthrough), forwarded verbatim on
+/// the rich-input plane (`RichInput::HidReport`, 0xCC). `buf` is a DIRECT ByteBuffer whose first
+/// `len` bytes are the report, id byte first (`0x42`/`0x45`/`0x47` state, `0x43` battery, …);
+/// `len` is clamped to the 64-byte wire body. Called from the capture thread at the controller's
+/// own report rate (~250–500 Hz) — the direct-buffer read avoids a JNI array copy per report.
+#[no_mangle]
+pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeSendPadHidReport(
+    env: JNIEnv,
+    _this: JObject,
+    handle: jlong,
+    pad: jint,
+    buf: JByteBuffer,
+    len: jint,
+) {
+    if handle == 0 || len <= 0 {
+        return;
+    }
+    let cap = match env.get_direct_buffer_capacity(&buf) {
+        Ok(c) => c,
+        Err(_) => return,
+    };
+    let ptr = match env.get_direct_buffer_address(&buf) {
+        Ok(p) if !p.is_null() => p,
+        _ => return,
+    };
+    let n = (len as usize).min(cap).min(HID_REPORT_MAX);
+    let mut data = [0u8; HID_REPORT_MAX];
+    // SAFETY: `ptr`/`cap` describe the direct ByteBuffer's backing store, valid for this call;
+    // `n` is bounded by both the buffer capacity and the fixed wire body.
+    data[..n].copy_from_slice(unsafe { std::slice::from_raw_parts(ptr, n) });
+    // SAFETY: live handle per the nativeConnect/nativeClose contract; send_rich_input is &self.
+    let h = unsafe { &*(handle as *const SessionHandle) };
+    let _ = h.client.send_rich_input(RichInput::HidReport {
+        pad: (pad as u32 & 0xF) as u8,
+        len: n as u8,
+        data,
+    });
+}