Per-subsystem hook control: install/remove input, focus, audio at runtime

Add a host->hook control channel (protocol v5 -> v6: HookControl in SharedBlock,
per-subsystem "disabled" flags, 0 = install so the zero-filled default is
unchanged). The worker now reconciles each subsystem every tick: install what's
requested-and-missing, remove what's no longer wanted -- so the audio hooks
re-attach the ring and republish format on a reinstall, and XInput/focus clear
their stale status flags on removal.

Injection panel: a checkbox per subsystem (input forwarding / focus spoof /
audio render-hook) toggles it at runtime, showing the requested vs actual
installed state from the registry, plus DLL heartbeat liveness. The hook-status
section now keys off whether a DLL was injected (host-side) rather than the
input-hook "attached" flag, so it stays visible with input unhooked.

Guards for dependent features: the synthetic-input control is disabled when
input forwarding is off, and the Audio panel explains that mirroring uses
loopback (echo) when the render-hook is off.

Verified against Phantom Brave via coop_audio_probe: starting with audio
requested off installs only input+focus (8 hooks, no capture); re-enabling at
runtime installs the audio hooks (13) and capture starts immediately. All four
tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

host/src/ipc/ipc_server.hpp

@@ -52,6 +52,10 @@ public:
 	// Reads the hook's diagnostics back-channel (zeroed if not started).
 	[[nodiscard]] HookStatusView hook_status() const;
 
+	// Request a hook subsystem be installed (true) or removed (false). The hook
+	// reconciles on its next tick. No-op if not started.
+	void set_subsystem_enabled(std::uint32_t subsystem, bool enabled);
+
 	[[nodiscard]] bool running() const
 	{
 		return block_ != nullptr;