feat: wire display + input servers to snake, fix QEMU 11.x GPU bug

VirtIO GPU: QEMU 11.x has RESOURCE_ATTACH_BACKING (0x0104) and
RESOURCE_FLUSH (0x0106) command types swapped in its legacy MMIO
VirtIO GPU implementation. Workaround: send swapped type values.
Confirmed via QEMU monitor (xp shows correct bytes in memory)
and QEMU trace events (device dispatches to wrong handler).

Display pipeline now works end-to-end:
  adapter → GPU init → create_2d → attach_backing → set_scanout
  display-server → clear(blue) → flush → transfer + resource_flush
  snake → draw commands via IPC → display renders → flush to GPU

Input server:
  - New driver-input-uart crate (reads UART at mapped VA 0x20000)
  - New bins/input-qemu composition root
  - Adapter loads input-server, maps UART MMIO into its address space
  - Init delegates both display_ep (slot 0) and input_ep (slot 1) to snake
  - WASD keys → UART → input-server → IPC → snake direction change

Snake game runs with display and input, exits on wall collision.

crates/drivers/input/uart/Cargo.toml

@@ -0,0 +1,7 @@
+[package]
+name = "driver-input-uart"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+port-input-device = { workspace = true }

crates/drivers/input/uart/src/lib.rs

@@ -0,0 +1,47 @@
+#![no_std]
+
+use port_input_device::{InputDevice, InputEvent, Key};
+
+const UART_VA: usize = 0x20000;
+const UART_LSR_OFFSET: usize = 5;
+
+pub struct UartInputDevice;
+
+impl UartInputDevice {
+    pub fn new() -> Self {
+        Self
+    }
+
+    fn read_byte(&self) -> Option<u8> {
+        let lsr = unsafe { core::ptr::read_volatile((UART_VA + UART_LSR_OFFSET) as *const u8) };
+        if lsr & 1 != 0 {
+            Some(unsafe { core::ptr::read_volatile(UART_VA as *const u8) })
+        } else {
+            None
+        }
+    }
+
+    fn byte_to_key(byte: u8) -> Key {
+        match byte {
+            b'w' | b'W' => Key::Up,
+            b's' | b'S' => Key::Down,
+            b'a' | b'A' => Key::Left,
+            b'd' | b'D' => Key::Right,
+            b'\r' | b'\n' => Key::Enter,
+            0x1B => Key::Escape,
+            c => Key::Char(c),
+        }
+    }
+}
+
+impl InputDevice for UartInputDevice {
+    fn poll(&mut self) -> Option<InputEvent> {
+        let byte = self.read_byte()?;
+        Some(InputEvent::KeyDown(Self::byte_to_key(byte)))
+    }
+
+    fn has_event(&self) -> bool {
+        let lsr = unsafe { core::ptr::read_volatile((UART_VA + UART_LSR_OFFSET) as *const u8) };
+        lsr & 1 != 0
+    }
+}