feat: wire display + input servers to snake, fix QEMU 11.x GPU bug

VirtIO GPU: QEMU 11.x has RESOURCE_ATTACH_BACKING (0x0104) and
RESOURCE_FLUSH (0x0106) command types swapped in its legacy MMIO
VirtIO GPU implementation. Workaround: send swapped type values.
Confirmed via QEMU monitor (xp shows correct bytes in memory)
and QEMU trace events (device dispatches to wrong handler).

Display pipeline now works end-to-end:
  adapter → GPU init → create_2d → attach_backing → set_scanout
  display-server → clear(blue) → flush → transfer + resource_flush
  snake → draw commands via IPC → display renders → flush to GPU

Input server:
  - New driver-input-uart crate (reads UART at mapped VA 0x20000)
  - New bins/input-qemu composition root
  - Adapter loads input-server, maps UART MMIO into its address space
  - Init delegates both display_ep (slot 0) and input_ep (slot 1) to snake
  - WASD keys → UART → input-server → IPC → snake direction change

Snake game runs with display and input, exits on wall collision.

Cargo.lock

@@ -56,6 +56,7 @@ version = "0.1.0"
 dependencies = [
  "display-server",
  "driver-framebuffer-virtio",
+ "port-framebuffer",
  "server-framework",
  "types",
  "userspace",
@@ -105,6 +106,13 @@ dependencies = [
  "types",
 ]
 
+[[package]]
+name = "driver-input-uart"
+version = "0.1.0"
+dependencies = [
+ "port-input-device",
+]
+
 [[package]]
 name = "echo"
 version = "0.1.0"
@@ -150,6 +158,18 @@ dependencies = [
  "userspace-rt",
 ]
 
+[[package]]
+name = "input-qemu"
+version = "0.1.0"
+dependencies = [
+ "driver-input-uart",
+ "input-server",
+ "server-framework",
+ "types",
+ "userspace",
+ "userspace-rt",
+]
+
 [[package]]
 name = "input-server"
 version = "0.1.0"