feat(steam): M4 complete — C-ABI send path, Decky UX, Apple/Android parity

Finish the client side of the Steam Controller / Steam Deck pipeline.

- C-ABI (core abi.rs): PunktfunkRichInputEx — a size-prefixed superset of
  PunktfunkRichInput that can express the second trackpad (surface), a distinct
  click vs touch, signed coords + pressure — plus
  punktfunk_connection_send_rich_input2 (the struct_size ABI-skew-guard
  precedent). The only way a C client (Apple/embedders) can emit a TouchpadEx;
  the legacy struct + send_rich_input stay byte-for-byte. punktfunk_core.h
  regenerated.

- Decky (clients/decky): a "Steam Deck" gamepad type in Settings + an unmissable
  Disable-Steam-Input instruction shown when it's selected (in Game Mode Steam
  Input holds 0x1205, so the SDL HIDAPI Steam driver can't open the Deck's
  controls until the user disables Steam Input for the shortcut). Plus a
  best-effort, feature-detected disableSteamInputForShortcut() in launchStream —
  never blocks/throws; the manual toggle is the documented source of truth.

- Apple parity (PunktfunkConnection.swift): GamepadType.steamController/steamDeck
  (wire 5/6) + name parsing, so the resolved type round-trips. Capture is blocked
  (GameController never surfaces a 0x28DE HID device).

- Android parity (Gamepad.kt): PREF_STEAMCONTROLLER/STEAMDECK + the Valve 0x28DE
  PIDs in prefFor(). Rich-input capture stays out of scope (no rich-input plane
  yet) — standard buttons/sticks resolve to the host's Steam Deck pad.

Rust workspace clippy/fmt/test green; Decky src/ typechecks clean (only a
pre-existing @decky/api dep resolution error remains); Swift/Kotlin compile on
their CI. The full pipeline is now BUILT; what remains is validation that needs
hardware we don't have (a running Steam on the host, a live Deck client, the
Moonlight paddle regression). Not pushed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

clients/decky/src/index.tsx

@@ -294,7 +294,13 @@ const RESOLUTIONS: [number, number, string][] = [
   [2560, 1440, "2560 × 1440"],
 ];
 const REFRESH = [0, 30, 60, 90, 120];
-const GAMEPADS = ["auto", "xbox360", "dualsense"];
+const GAMEPADS = ["auto", "xbox360", "dualsense", "steamdeck"];
+const GAMEPAD_LABELS: Record<string, string> = {
+  auto: "Automatic",
+  xbox360: "Xbox 360",
+  dualsense: "DualSense",
+  steamdeck: "Steam Deck",
+};
 
 const SettingsSection: FC = () => {
   const [s, setS] = useState<StreamSettings | null>(null);
@@ -355,14 +361,17 @@ const SettingsSection: FC = () => {
       />
       <Field label="Gamepad type" childrenContainerWidth="max">
         <Dropdown
-          rgOptions={GAMEPADS.map((g) => ({
-            data: g,
-            label: g === "auto" ? "Automatic" : g === "xbox360" ? "Xbox 360" : "DualSense",
-          }))}
+          rgOptions={GAMEPADS.map((g) => ({ data: g, label: GAMEPAD_LABELS[g] ?? g }))}
           selectedOption={s.gamepad}
           onChange={(o) => patch({ gamepad: o.data as string })}
         />
       </Field>
+      {s.gamepad === "steamdeck" && (
+        <Field
+          label="⚠ Disable Steam Input"
+          description="Steam Deck mode forwards the paddles, both trackpads, and gyro to the host. For that, Steam Input must be OFF for punktfunk: on the game page tap ⚙ → Controller Settings → set Steam Input to Off. Otherwise Steam keeps the Deck's controls and only the sticks + buttons reach the host."
+        />
+      )}
       <ToggleField
         label="Stream microphone"
         checked={s.mic_enabled}

clients/decky/src/steam.ts

@@ -113,12 +113,35 @@ async function ensureShortcut(): Promise<number> {
   return appId;
 }
 
+/**
+ * Best-effort: turn Steam Input OFF for our shortcut so SDL's HIDAPI Steam Deck driver can open the
+ * Deck's controls (paddles · trackpads · gyro) directly. There is no confirmed-stable SteamClient
+ * API for this, so it is feature-detected and MUST never block or throw into the launch — the manual
+ * toggle (game page → ⚙ → Controller Settings → Steam Input Off, surfaced in the plugin Settings) is
+ * the documented source of truth. No-op when the optional API is absent.
+ */
+function disableSteamInputForShortcut(appId: number): void {
+  try {
+    const input = (
+      SteamClient as unknown as {
+        Input?: { SetSteamInputEnabledForApp?: (appId: number, enabled: boolean) => void };
+      }
+    ).Input;
+    input?.SetSteamInputEnabledForApp?.(appId, false);
+  } catch {
+    /* a controller tweak must never break the launch */
+  }
+}
+
 /**
  * Launch a stream to `host:port` fullscreen in Gaming Mode. Encodes the target into the
  * shortcut's launch options (so one generic shortcut serves every host), then RunGame.
  */
 export async function launchStream(host: string, port: number): Promise<void> {
   const appId = await ensureShortcut();
+  // Best-effort so the Deck's rich controls reach the client; no-op if the API is absent (the user
+  // disables Steam Input manually — see the Settings instruction).
+  disableSteamInputForShortcut(appId);
   const target = port && port !== 9777 ? `${host}:${port}` : host;
   // KEY=value ... %command% — the wrapper reads PF_HOST from the environment.
   SteamClient.Apps.SetAppLaunchOptions(appId, `PF_HOST=${target} %command%`);