feat: wire display + input servers to snake, fix QEMU 11.x GPU bug

VirtIO GPU: QEMU 11.x has RESOURCE_ATTACH_BACKING (0x0104) and
RESOURCE_FLUSH (0x0106) command types swapped in its legacy MMIO
VirtIO GPU implementation. Workaround: send swapped type values.
Confirmed via QEMU monitor (xp shows correct bytes in memory)
and QEMU trace events (device dispatches to wrong handler).

Display pipeline now works end-to-end:
  adapter → GPU init → create_2d → attach_backing → set_scanout
  display-server → clear(blue) → flush → transfer + resource_flush
  snake → draw commands via IPC → display renders → flush to GPU

Input server:
  - New driver-input-uart crate (reads UART at mapped VA 0x20000)
  - New bins/input-qemu composition root
  - Adapter loads input-server, maps UART MMIO into its address space
  - Init delegates both display_ep (slot 0) and input_ep (slot 1) to snake
  - WASD keys → UART → input-server → IPC → snake direction change

Snake game runs with display and input, exits on wall collision.

crates/bins/display-qemu/src/main.rs

@@ -8,7 +8,20 @@ use types::bounded::CapSlot;
 
 #[unsafe(no_mangle)]
 extern "C" fn main() {
-    let fb = VirtioFramebuffer::new();
+    let mut fb = VirtioFramebuffer::new();
+
+    use port_framebuffer::Framebuffer;
+    use types::display::{Color, Dimension, ScreenCoord};
+
+    // Initial clear to dark blue so we know the GPU works
+    fb.clear(Color::rgb(0, 0, 40));
+    fb.fill_rect(
+        ScreenCoord::new(10), ScreenCoord::new(10),
+        Dimension::new(200), Dimension::new(30),
+        Color::rgb(255, 255, 255),
+    );
+    fb.flush();
+
     let mut srv = display_server::server::DisplayServer::new(fb);
     let ep = CapSlot::new(0).unwrap();
     server_framework::serve(&mut srv, ep);