feat: implement rumble TX over the GIP data path

Port the rumble packet from upstream driver/gamepad.c: a 9-byte
GIP_CMD_RUMBLE payload (motors R|L|RT|LT, intensities scaled to the
0..100 GIP range, duration/repeat constants). xone_controller_rumble
now sends it via client::send_rumble; the app button pulses both
motors for 0.6s then stops them. Completes the host to controller
TX remainder of Phase 3 (the dongle LED is already driven at chip
level for pairing and client lifecycle).

Co-Authored-By: qwen3.8-27b@q3_k_xl: implemented rumble TX

include/app/xone_api.h

@@ -100,11 +100,12 @@ int xone_controller_get_state(xone_dongle const *d, int index,
 // Enter or leave pairing mode (beacon pairing flag + LED blink).
 void xone_set_pairing(xone_dongle *d, bool enable);
 
-// Trigger a rumble test on the controller at index. Returns 0 on success,
-// -1 for an invalid session or index. Not implemented yet: host to
-// controller TX (GIP_CMD_RUMBLE payload) is pending, so this currently
-// returns -ENOSYS.
-int xone_controller_rumble(xone_dongle *d, int index);
+// Send a rumble packet to the controller at index (host to controller TX
+// over the GIP data path). Intensities use a 0..255 scale; passing zero for
+// both stops the motors. Returns 0 on success, -1 for an invalid session or
+// index, or if the client is not ready.
+int xone_controller_rumble(xone_dongle *d, int index, uint8_t left,
+                           uint8_t right);
 
 #ifdef __cplusplus
 }