feat(display): input routed via display server to focused app; input Subscribe; uses caps badged + Delegate

docs/ipc.md

@@ -84,6 +84,16 @@ and budget listed there. Storage, started before the log server, receives
 its log endpoint from init later (`SET_LOG`, accepted only from the
 unbadged holder of its endpoint).
 
+A program's `uses` endpoints arrive as badged copies with `Execute` and
+`Delegate`: the badge (unique per copy) tells the server which client is
+calling, and `Delegate` lets the client send capabilities with its calls
+and hand its access to programs it starts.
+
+Input reaches apps through the display server, the input server's only
+client. It subscribes to the input server with a notification, drains it
+when signalled, and passes events on to the app in focus: the last one to
+subscribe (`types::display::input`). Apps out of focus get nothing.
+
 Only init holds `ProcessCreate`. Everyone else runs programs through init's
 spawn service (`types::spawn`, client `libkos::spawn`), which init serves
 once boot is done. A manifest entry with `spawns` gets a badged copy of