input: one-packet pointer moves, uinput-only injection, fire-and-forget

- Pointer motion is now a single event carrying both coordinates (MOVE_ABS /
  MOVE_REL with x,y) rather than one event per axis; the adapter actuates both
  axes in a single batch. The per-axis ABS/REL kinds are removed.
- Input injection is uinput-only: the driver selection and the optional
  guest-side passthrough drop out of the adapter config (the driver is the
  driver's concern). A QMP path is still carried for the unchanged service
  power/lifecycle path.
- A per-event fire-and-forget flag lets a control inject input without an
  actuation acknowledgement, for high-rate streams; without it the addressed
  ACT_ACK is emitted as before. Service commands always acknowledge.

The neutral input payload gains x/y/flags, still within the inline event body.
Capability, lease and source gates are unchanged.

src/cli.c

@@ -106,9 +106,9 @@ static int on_event(void* user, const vmsig_event* ev) {
         in.prio = VMSIG_PRIO_HIGH; in.endpoint = 0; in.corr = 0xC0FFEEu;
         in.payload.flags = VMSIG_PL_INLINE;
         vmsig_input act; memset(&act, 0, sizeof act);   /* neutral public input contract */
-        act.kind = VMSIG_INPUT_ABS; act.code = 0; act.value = 100;   /* demo: abs axis X = 100 */
+        act.kind = VMSIG_INPUT_MOVE_ABS; act.x = 100; act.y = 100;   /* demo: abs pointer (100,100) */
         memcpy(in.inln, &act, sizeof act);
-        printf("  DOWN CMD_INPUT     ABS axis=0 val=100 corr=0x%X\n", (unsigned)in.corr);
+        printf("  DOWN CMD_INPUT     MOVE_ABS x=100 y=100 corr=0x%X\n", (unsigned)in.corr);
         vmsig_inproc_send(d->ctl, &in);
 
         vmsig_event vm;