feat: wire display + input servers to snake, fix QEMU 11.x GPU bug

VirtIO GPU: QEMU 11.x has RESOURCE_ATTACH_BACKING (0x0104) and
RESOURCE_FLUSH (0x0106) command types swapped in its legacy MMIO
VirtIO GPU implementation. Workaround: send swapped type values.
Confirmed via QEMU monitor (xp shows correct bytes in memory)
and QEMU trace events (device dispatches to wrong handler).

Display pipeline now works end-to-end:
  adapter → GPU init → create_2d → attach_backing → set_scanout
  display-server → clear(blue) → flush → transfer + resource_flush
  snake → draw commands via IPC → display renders → flush to GPU

Input server:
  - New driver-input-uart crate (reads UART at mapped VA 0x20000)
  - New bins/input-qemu composition root
  - Adapter loads input-server, maps UART MMIO into its address space
  - Init delegates both display_ep (slot 0) and input_ep (slot 1) to snake
  - WASD keys → UART → input-server → IPC → snake direction change

Snake game runs with display and input, exits on wall collision.

crates/adapter-riscv/src/devices/input_setup.rs

@@ -0,0 +1,19 @@
+use crate::hw::uart::Uart;
+use crate::{board, kernel_ref, mmu};
+use types::id::ProcessId;
+
+const UART_VA: usize = 0x20000;
+
+pub fn configure(uart: &Uart, input_pid: ProcessId) {
+    let pt_addr = kernel_ref().platform_mut().page_table_for(input_pid);
+    let pt = unsafe { &mut *(pt_addr as *mut mmu::PageTable) };
+
+    mmu::map(pt, mmu::Mapping {
+        va: types::address::VirtualAddress::from_raw(UART_VA),
+        pa: types::address::PhysicalAddress::from_raw(board::UART_BASE),
+        pages: 1,
+        flags: mmu::Sv39Flags::user_rw(),
+    });
+
+    uart.write_str("k-os: UART mapped for input\n");
+}