feat(input): daemon sets up the host->guest input-linux bridge via QMP

The uinput devices the input adapter creates were never forwarded into the
guest: the input-linux bridge was external (manual monitor object_add), so it
was lost on every reconfigure and whenever the kernel-assigned device numbers
changed. Make the vmhost seam -- which already owns the VM's single QMP
connection -- add the input-linux objects itself on reaching READY (A=keyboard
+abs with grab_all, B=mouse) and object_del them on teardown. The input adapter
publishes the uinput evdev paths into a per-endpoint home; discovery attaches
input before vmhost so the paths are ready. No second QMP socket or connection.

Also move the mouse buttons (incl. middle) and the wheel onto device B, so B is
a complete relative mouse and A is keyboard+abs only.

Bump 0.3.8.

src/adapter/vmhost/include/vmhost.h

@@ -8,6 +8,13 @@
 typedef struct {
     int         stub;
     const char* qmp_path;
+    /* Host->guest input bridge: evdev node paths of the uinput devices (published by the input
+     * seam). When non-NULL/non-empty, on reaching READY the seam adds an input-linux QMP object
+     * forwarding them into the guest (A=kbd+abs with grab_all, B=mouse). NULL/"" => no bridge
+     * (stub/tests are fail-closed). Pointers are borrowed from the stable per-endpoint home and
+     * outlive the adapter. */
+    const char* bridge_evdev_a;
+    const char* bridge_evdev_b;
 } vmsig_vmhost_cfg;
 
 #endif /* VMSIG_VMHOST_H */