refactor: drop milestone names + consolidate clients; loss-recovery & rumble fixes

Two bodies of work in one commit (the rename moved files the fixes also touched).

Naming/structure cleanup (pre-launch):
- Host modules m3.rs->punktfunk1.rs, m0.rs->spike.rs; CLI m3-host->punktfunk1-host,
  m0->spike; bare `punktfunk-host` now prints help. Types M3Options/M3Source->
  Punktfunk1Options/Punktfunk1Source.
- Clients consolidated out of crates/ into clients/: punktfunk-client-rs->
  clients/probe (crate punktfunk-probe), client-linux->clients/linux,
  client-windows->clients/windows, punktfunk-android->clients/android/native
  (crate punktfunk-client-android; kept [lib] name=punktfunk_android so the JNI
  contract is unchanged). crates/ now holds only core + host.
- Milestone codes M0-M4 purged from code/CLI/CLAUDE.md/README/docs/docs-site,
  kept only in docs/implementation-plan.md. docs/m2-plan.md->
  docs/gamestream-host-plan.md. CI/gradle/flatpak paths updated.

Client loss-recovery (video froze and never recovered after a brief drop):
- Export punktfunk_connection_frames_dropped through the C ABI (the core already
  tracked it for the client keyframe-recovery loop; it was never reachable from
  the ABI clients). Regenerated punktfunk_core.h.
- Apple (StreamPump + Stage2Pipeline) and Android (decode.rs) now poll
  frames_dropped and request a keyframe when it climbs -- the same loss-driven
  recovery Linux/Windows already had. Under infinite GOP the decoder silently
  conceals reference-missing frames, so the decode-error trigger rarely fires.

Apple rumble robustness (worked then went spotty -- DualSense + Xbox):
- Add CHHapticEngine stopped/reset handlers (rebuild on app background / audio
  interruption / server reset) and drop the permanent `broken` latch on a
  transient drive failure; latch only when the controller truly has no haptics.
- Surface swallowed SDL set_rumble errors on Linux/Windows + diagnostic logging.

Verified: cargo build/clippy/fmt --workspace, C-ABI harness, header drift.
Not runnable on this box (verify in CI): Gitea workflows, gradle/Android,
flatpak, Swift/decky.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/windows-secure-desktop.md

@@ -11,7 +11,7 @@ need conflicting process tokens.
 Implemented so far:
 - **Step 1 — DesktopWatcher** (`capture/desktop_watch.rs`): polls the input-desktop name → atomic
   `Default`/`Winlogon`. Committed `80e222d`.
-- **Step 3 — WGC helper subcommand** (`wgc_helper.rs`, `m3-host wgc-helper`): WGC→NVENC→framed AUs on
+- **Step 3 — WGC helper subcommand** (`wgc_helper.rs`, `punktfunk1-host wgc-helper`): WGC→NVENC→framed AUs on
   stdout, stdin keyframe control. Committed `a0f6cdd`.
 - **Step 4 — spawn + relay** (`capture/wgc_relay.rs`, `m3::virtual_stream_relay`): SYSTEM host spawns
   the helper via `CreateProcessAsUserW` into `winsta0\default`, relays its stdout AUs to the QUIC send
@@ -64,12 +64,12 @@ proven by the timed toggle, and DDA-on-Winlogon capture + input by the single-pr
 
 ## Architecture: SYSTEM host + USER-session WGC helper, AU-relay (no shared GPU texture)
 
-- **SYSTEM host** (the existing `m3-host`, launched as SYSTEM in interactive Session 1 via the
+- **SYSTEM host** (the existing `punktfunk1-host`, launched as SYSTEM in interactive Session 1 via the
   scheduled task → PsExec `-s -i 1`): owns the punktfunk/1 QUIC session, the single SudoVDA virtual
   output (+ isolate/restore RAII — the *only* topology owner), the **DDA capture + NVENC encoder for
   the secure desktop**, the **single SendInput injector** (serves *both* desktops), and the **AU
   source mux** that feeds the QUIC data plane.
-- **USER-session WGC helper** (a new `m3-host` subcommand, spawned by the SYSTEM host via
+- **USER-session WGC helper** (a new `punktfunk1-host` subcommand, spawned by the SYSTEM host via
   `WTSQueryUserToken(activeConsoleSessionId)` → `DuplicateTokenEx(TokenPrimary)` →
   `CreateProcessAsUserW(lpDesktop="winsta0\\default", CREATE_NO_WINDOW)`): runs the existing
   **WGC → scRGB/PQ → NVENC** pipeline and ships **Annex-B AUs** (`{data, pts_ns, keyframe}`) to the
@@ -104,7 +104,7 @@ miss UAC entirely. (May also register `WTSRegisterSessionNotification` to short-
 2. **SendInput retry-on-failure model** (`inject/sendinput.rs`): replace per-event reattach with the
    cached-HDESK + retry-once model. Test: normal input unchanged; click UAC + type the lock password
    land (works today via per-event reattach — this is a refactor).
-3. **WGC helper subcommand** (`m3-host wgc-helper` or similar): the existing WGC pipeline → NVENC →
+3. **WGC helper subcommand** (`punktfunk1-host wgc-helper` or similar): the existing WGC pipeline → NVENC →
    Annex-B AUs over a named-pipe server. Test standalone: as the user it writes a valid `.h265` to the
    pipe (capturing the SudoVDA output by GDI name, no topology changes).
 4. **Spawn + relay**: SYSTEM host spawns the helper (`CreateProcessAsUserW`), connects the pipe,