feat(android): declare pad-audio caps and take tier-A pads off wire rumble

The two things that decide whether WP9 does anything at all on a device, both
failing silently rather than loudly if missed.

**Capability bits.** The host emits 0xD1 only toward pads that declared they can
render it (arrival flags 8/9). Without `set_pad_audio_caps` the renderer would
sit on a permanently empty plane and look like a decode bug. Declared when the
stream opens, withdrawn when it stops.

**Rumble arbitration.** `valid_flag0` bit 1 (HAPTICS_SELECT) *disables* audio
haptics and selects classic rumble, and `DsDevice` sets it on every rumble write
— as Linux's hid-playstation and SDL both do. One replayed rumble command would
mute the voice coils the 0xD1 stream is driving, for the rest of the session.
Tier A and tier C are mutually exclusive in the pad's firmware, so the
arbitration selects and never blends.

Suppression sits at `nativeNextRumble`, the pull point, rather than in Kotlin:
it keeps the rule next to the reason and covers every caller. The registry is an
atomic bitmask because the reader is the rumble poll thread and must not block
behind a start/stop on the JNI thread.

Order matters on teardown: the capability is withdrawn before the pad returns to
wire rumble, so the host has stopped sending 0xD1 before tier C resumes and the
two never overlap.

`nativeStartPadAudio`/`nativeStopPadAudio` now take the wire pad index, since
both the capability and the arbitration are per-pad. Out-of-range indices are
rejected rather than wrapped into another pad's slot.

12 host tests (2 new, including one pinning that an out-of-range index cannot
shift the mask into undefined territory), 0 clippy findings, check clean on all
three Android ABIs.

clients/android/native/src/session/planes.rs

@@ -460,7 +460,7 @@ pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeStopMic(
     })
 }
 
-/// `NativeBridge.nativeStartPadAudio(handle, fd, haptics, speaker): Boolean` — start tier-A
+/// `NativeBridge.nativeStartPadAudio(handle, pad, fd, haptics, speaker): Boolean` — start tier-A
 /// DualSense pad audio on a descriptor Kotlin has already obtained.
 ///
 /// `fd` comes from `UsbDeviceConnection.getFileDescriptor()` **after** claiming the pad's audio
@@ -478,12 +478,13 @@ pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeStartPadAud
     _env: JNIEnv,
     _this: JObject,
     handle: jlong,
+    pad: jni::sys::jint,
     fd: jni::sys::jint,
     haptics: jboolean,
     speaker: jboolean,
 ) -> jboolean {
     jni_guard(0, || {
-        if handle == 0 || fd < 0 {
+        if handle == 0 || fd < 0 || !(0..16).contains(&pad) {
             return 0;
         }
         // SAFETY: live handle per the nativeConnect/nativeClose contract.
@@ -499,6 +500,15 @@ pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeStartPadAud
         ) {
             Some(p) => {
                 *h.pad_audio.lock().unwrap() = Some(p);
+                // Declare what this pad can render. Without these bits the host never emits 0xD1
+                // for it at all, so the renderer would sit on an empty plane forever — the bits
+                // ride the gamepad arrival (flags 8/9) toward a HOST_CAP_PAD_AUDIO host.
+                let caps =
+                    (if haptics != 0 { 0x01 } else { 0 }) | (if speaker != 0 { 0x02 } else { 0 });
+                h.client.set_pad_audio_caps(pad as u8, caps);
+                // And take this pad off wire rumble: tier A and tier C are mutually exclusive in
+                // the pad's firmware (see `pad_audio::is_tier_a`).
+                crate::pad_audio::set_tier_a(pad as u8, true);
                 1
             }
             None => 0,
@@ -506,7 +516,7 @@ pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeStartPadAud
     })
 }
 
-/// `NativeBridge.nativeStopPadAudio(handle)` — stop tier-A pad audio and join its thread.
+/// `NativeBridge.nativeStopPadAudio(handle, pad)` — stop tier-A pad audio and join its thread.
 ///
 /// Returns only once the render thread is joined, which is the point: Kotlin may close the
 /// `UsbDeviceConnection` as soon as this returns and not before.
@@ -516,12 +526,19 @@ pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeStopPadAudi
     _env: JNIEnv,
     _this: JObject,
     handle: jlong,
+    pad: jni::sys::jint,
 ) {
     jni_guard((), || {
         if handle != 0 {
             // SAFETY: live handle per the nativeConnect/nativeClose contract.
             let h = unsafe { &*(handle as *const SessionHandle) };
             h.stop_pad_audio();
+            if (0..16).contains(&pad) {
+                // Withdraw the capability and hand the pad back to wire rumble, in that order:
+                // the host stops sending 0xD1 before tier C resumes, so the two never overlap.
+                h.client.set_pad_audio_caps(pad as u8, 0);
+                crate::pad_audio::set_tier_a(pad as u8, false);
+            }
         }
     })
 }