feat(input): daemon sets up the host->guest input-linux bridge via QMP

The uinput devices the input adapter creates were never forwarded into the
guest: the input-linux bridge was external (manual monitor object_add), so it
was lost on every reconfigure and whenever the kernel-assigned device numbers
changed. Make the vmhost seam -- which already owns the VM's single QMP
connection -- add the input-linux objects itself on reaching READY (A=keyboard
+abs with grab_all, B=mouse) and object_del them on teardown. The input adapter
publishes the uinput evdev paths into a per-endpoint home; discovery attaches
input before vmhost so the paths are ready. No second QMP socket or connection.

Also move the mouse buttons (incl. middle) and the wheel onto device B, so B is
a complete relative mouse and A is keyboard+abs only.

Bump 0.3.8.

src/si/input/open.c

@@ -154,3 +154,13 @@ unsigned vmctl_btns_snapshot(vmctl_t* v) {
     if (!v) return 0;
     return v->btns_held;
 }
+
+/* ===== uinput evdev export (UINPUT-only) ===== */
+
+int vmctl_uinput_evdev(vmctl_t* v, char a[64], char b[64]) {
+    if (!v || v->driver != VMCTL_DRIVER_UINPUT) return -1;
+    int n = 0;
+    if (a) { memcpy(a, v->ui_evdev_a, sizeof v->ui_evdev_a); if (a[0]) n++; }
+    if (b) { memcpy(b, v->ui_evdev_b, sizeof v->ui_evdev_b); if (b[0]) n++; }
+    return n;
+}