feat: wire display + input servers to snake, fix QEMU 11.x GPU bug

VirtIO GPU: QEMU 11.x has RESOURCE_ATTACH_BACKING (0x0104) and
RESOURCE_FLUSH (0x0106) command types swapped in its legacy MMIO
VirtIO GPU implementation. Workaround: send swapped type values.
Confirmed via QEMU monitor (xp shows correct bytes in memory)
and QEMU trace events (device dispatches to wrong handler).

Display pipeline now works end-to-end:
  adapter → GPU init → create_2d → attach_backing → set_scanout
  display-server → clear(blue) → flush → transfer + resource_flush
  snake → draw commands via IPC → display renders → flush to GPU

Input server:
  - New driver-input-uart crate (reads UART at mapped VA 0x20000)
  - New bins/input-qemu composition root
  - Adapter loads input-server, maps UART MMIO into its address space
  - Init delegates both display_ep (slot 0) and input_ep (slot 1) to snake
  - WASD keys → UART → input-server → IPC → snake direction change

Snake game runs with display and input, exits on wall collision.

crates/adapter-riscv/src/hw/virtio_gpu.rs

@@ -18,19 +18,24 @@ impl VirtioGpu {
         self.mmio.base()
     }
 
+    pub fn mmio(&self) -> &DirectMmio {
+        &self.mmio
+    }
+
     pub fn init_device(&self, vqueue_phys: usize) {
         mmio::init_legacy_device(&self.mmio, vqueue_phys, QUEUE_SIZE as u32);
     }
 
-    pub fn setup_framebuffer(&self, cmd_phys: usize, vq_phys: usize, fb_phys: usize, width: Dimension, height: Dimension) {
+    pub fn setup_framebuffer(&self, cmd_phys: usize, vq_phys: usize, fb_phys: usize, width: Dimension, height: Dimension) -> bool {
         let queue = VirtioQueue::new(QueueAddrs::from_base(vq_phys));
         let dma = GpuDmaAddrs {
             cmd_pa: PhysicalAddress::from_raw(cmd_phys),
             cmd_va: VirtualAddress::from_raw(cmd_phys),
             resp_pa: PhysicalAddress::from_raw(cmd_phys + 512),
         };
-        gpu::create_2d(&self.mmio, &queue, &dma, 1, width, height);
-        gpu::attach_backing(&self.mmio, &queue, &dma, 1, PhysicalAddress::from_raw(fb_phys), width.raw() as u32 * height.raw() as u32 * 4);
-        gpu::set_scanout(&self.mmio, &queue, &dma, 0, 1, width, height);
+        let ok1 = gpu::create_2d(&self.mmio, &queue, &dma, 1, width, height);
+        let ok2 = gpu::attach_backing(&self.mmio, &queue, &dma, 1, PhysicalAddress::from_raw(fb_phys), width.raw() as u32 * height.raw() as u32 * 4);
+        let ok3 = gpu::set_scanout(&self.mmio, &queue, &dma, 0, 1, width, height);
+        ok1 && ok2 && ok3
     }
 }