feat(input): daemon sets up the host->guest input-linux bridge via QMP

The uinput devices the input adapter creates were never forwarded into the
guest: the input-linux bridge was external (manual monitor object_add), so it
was lost on every reconfigure and whenever the kernel-assigned device numbers
changed. Make the vmhost seam -- which already owns the VM's single QMP
connection -- add the input-linux objects itself on reaching READY (A=keyboard
+abs with grab_all, B=mouse) and object_del them on teardown. The input adapter
publishes the uinput evdev paths into a per-endpoint home; discovery attaches
input before vmhost so the paths are ready. No second QMP socket or connection.

Also move the mouse buttons (incl. middle) and the wheel onto device B, so B is
a complete relative mouse and A is keyboard+abs only.

Bump 0.3.8.

include/vmctl.h

@@ -38,6 +38,12 @@ typedef struct {
 vmctl_t* vmctl_open (const vmctl_config* cfg);   /* NULL on error    */
 void     vmctl_close(vmctl_t* v);                /* safe on NULL     */
 
+/* Copy the host evdev node paths of the created uinput devices (UINPUT driver only).
+ * a[] receives device A, b[] receives device B (empty if not VMCTL_PTR_BOTH); each buffer
+ * must be >=64 bytes. Returns the count of non-empty paths filled (0/1/2), or -1 if the
+ * handle's driver is not UINPUT. Paths are valid while the handle is open. */
+int vmctl_uinput_evdev(vmctl_t* v, char a[64], char b[64]);
+
 /* ===== Input constants ===== */
 #define VMCTL_ABS_MAX    32767       /* abs coordinates 0..VMCTL_ABS_MAX */
 #define VMCTL_AXIS_X     0