usb: enumerate devices behind a hub — route strings + transaction translators (B4b)

The core of hub support (docs/usb-hub.md): a device on a hub's
downstream port now reaches its class driver exactly like one on a root
port. The hub's interrupt status-change endpoint is armed with an
in-process subscription — completions set the hub's pending-port mask
instead of queuing a class-driver report — and setupHub seeds every
downstream port pending so a STATIC topology (a device present at
power-on) enumerates without waiting on the initial interrupt edge.

On the bus tick, each pending hub port is serviced: GET_STATUS + clear
the change bits, and on a connect reset the port, read the speed, then
enable a slot and Address Device with the composed route string
((parent_route<<4)|port), the inherited root port, and the parent hub's
slot/port as the TRANSACTION TRANSLATOR — so the controller routes a
full/low-speed device's split transactions through the hub's TT. The
device then enumerates and registers its interfaces through the normal
path (a compact topology-unique port key keeps the id tag within its
8-byte cap), recursing setupHub if it is itself a hub.

Verified in QEMU (a keyboard behind a USB2 hub on a second controller):
'hub slot 1 port 1 device vendor 0x0627 ... usb-hid-keyboard: ok
(device 35)'. Full suite 89/89. The user's SuperSpeed Genesys hub +
full-speed keyboard/mouse on its USB2 companion is the real-hardware
target, flagged separately.

test/qemu_test.py

@@ -476,7 +476,11 @@ CASES = [
      "qemu_extra": ["-device", "qemu-xhci,id=xhci2",
                     "-device", "usb-hub,bus=xhci2.0,port=1",
                     "-device", "usb-kbd,bus=xhci2.0,port=1.1"],
-     "expect": r"hub slot \d+: \d+ downstream ports powered",
+     # B4a: the hub powers its ports. B4b: the keyboard behind it enumerates
+     # (route string + TT) and binds usb-hid-keyboard.
+     "expect": r"(?s)(?=.*hub slot \d+: \d+ downstream ports powered)"
+               r"(?=.*hub slot \d+ port \d+ device vendor 0x0627)"
+               r"(?=.*usb-hid-keyboard: ok \(device 3)",
      "fail":   r"DANOS-TEST-RESULT: FAIL"},
     # USB mass storage end to end: the boot usb-storage device (the FAT32 image,
     # which has a real 0x55AA boot sector) is enough — the manager spawns