feat: wire display + input servers to snake, fix QEMU 11.x GPU bug

VirtIO GPU: QEMU 11.x has RESOURCE_ATTACH_BACKING (0x0104) and
RESOURCE_FLUSH (0x0106) command types swapped in its legacy MMIO
VirtIO GPU implementation. Workaround: send swapped type values.
Confirmed via QEMU monitor (xp shows correct bytes in memory)
and QEMU trace events (device dispatches to wrong handler).

Display pipeline now works end-to-end:
  adapter → GPU init → create_2d → attach_backing → set_scanout
  display-server → clear(blue) → flush → transfer + resource_flush
  snake → draw commands via IPC → display renders → flush to GPU

Input server:
  - New driver-input-uart crate (reads UART at mapped VA 0x20000)
  - New bins/input-qemu composition root
  - Adapter loads input-server, maps UART MMIO into its address space
  - Init delegates both display_ep (slot 0) and input_ep (slot 1) to snake
  - WASD keys → UART → input-server → IPC → snake direction change

Snake game runs with display and input, exits on wall collision.

crates/adapter-riscv/src/main.rs

@@ -48,12 +48,14 @@ extern "C" fn kmain() -> ! {
     let (init, _) = boot::loader::load_init(&uart, &mut blk, kernel_pt);
     let storage = boot::loader::load_server(&uart, &mut blk, kernel_pt, b"storage.elf", "storage");
     let display = boot::loader::load_server(&uart, &mut blk, kernel_pt, b"display.elf", "display");
+    let input = boot::loader::load_server(&uart, &mut blk, kernel_pt, b"input.elf", "input");
     let virtio_base = blk.base();
     drop(blk);
 
     devices::storage_setup::configure(&uart, init.pid, storage.pid, virtio_base);
     devices::gpu_setup::configure(&uart, display.pid);
-    boot::caps::grant_all(&uart, init.pid, storage.pid, display.pid);
+    devices::input_setup::configure(&uart, input.pid);
+    boot::caps::grant_all(&uart, init.pid, storage.pid, display.pid, input.pid);
 
     uart.write_str("k-os: entering userspace\n");
     boot::loader::enter_userspace(init.pid, init.entry, SHARED_BUF_VA);