input: one-packet pointer moves, uinput-only injection, fire-and-forget

- Pointer motion is now a single event carrying both coordinates (MOVE_ABS /
  MOVE_REL with x,y) rather than one event per axis; the adapter actuates both
  axes in a single batch. The per-axis ABS/REL kinds are removed.
- Input injection is uinput-only: the driver selection and the optional
  guest-side passthrough drop out of the adapter config (the driver is the
  driver's concern). A QMP path is still carried for the unchanged service
  power/lifecycle path.
- A per-event fire-and-forget flag lets a control inject input without an
  actuation acknowledgement, for high-rate streams; without it the addressed
  ACT_ACK is emitted as before. Service commands always acknowledge.

The neutral input payload gains x/y/flags, still within the inline event body.
Capability, lease and source gates are unchanged.

src/adapter/input/include/input.h

@@ -2,14 +2,12 @@
 #define VMSIG_INPUT_H
 
 /* Private config of the input adapter (vmctl). cfg==NULL => stub mode. Armed mode
- * (VMSIG_WITH_VMCTL) opens vmctl_open() and actuates for real. driver is an int so
- * as not to pull vmctl.h into this header (values match VMCTL_DRIVER_*). */
+ * (VMSIG_WITH_VMCTL) opens vmctl_open() and actuates for real. Injection is ALWAYS
+ * uinput (orphaned host uinput + external QEMU input-linux). qmp_path is kept for the
+ * SERVICE path (power/lifecycle via vmctl QMP), not for input injection. */
 typedef struct {
     int         stub;
-    int         driver;       /* 0=QMP, 1=UINPUT (see VMCTL_DRIVER_*)     */
-    const char* qmp_path;
-    const char* input_bus;
-    int         ptr_mode;
+    const char* qmp_path;     /* for power/lifecycle (vmctl QMP); NOT input injection */
 } vmsig_input_cfg;
 
 /* Input event codes/contract are PUBLIC: vmsig_input / vmsig_input_kind in