feat(host+inject): pen P1 — per-session uinput virtual tablet, HOST_CAP_PEN live

The Linux injection leg of design/pen-tablet-input.md: 0xCC/0x05 pen batches now
route through the per-session PenTracker into a lazily-created 'Punktfunk Pen'
uinput tablet (BTN_TOOL_PEN/RUBBER, pressure, tilt-from-polar, ABS_Z barrel
roll, hover distance, INPUT_PROP_DIRECT) — compositors pick it up via libinput
and hand apps zwp_tablet_v2 with full fidelity. The host now advertises
HOST_CAP_PEN when /dev/uinput is accessible (PUNKTFUNK_PEN=0 kill-switch);
transitions group into SYN frames so proximity-enter carries its position.
Stroke failsafe: clients heartbeat ≤100ms while in range (documented wire
contract — capture APIs are silent for a stationary pen); 200ms of silence
force-releases. 'punktfunk-host pen-test' draws a pressure-ramped sine stroke
through the real tracker→uinput chain, no client needed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-host/src/native.rs

@@ -1066,6 +1066,14 @@ async fn serve_session(
                 if rich_tx.send(ClientInput::Rich(rich)).is_err() {
                     break;
                 }
+            } else if let Some(pen) = punktfunk_core::quic::PenBatch::decode(&d) {
+                // 0xCC kind 0x05 — the stylus plane (RichInput::decode returns None for it by
+                // design; see punktfunk_core::quic::pen). Routed to the same input thread,
+                // which owns the per-session tracker + virtual tablet.
+                rich_count += 1;
+                if rich_tx.send(ClientInput::Pen(pen)).is_err() {
+                    break;
+                }
             } else if let Some(mut ev) = InputEvent::decode(&d) {
                 input_count += 1;
                 // Wire hygiene: KEY_FLAG_SEMANTIC_VK is an in-process tag (GameStream ingest