feat: proper IPC-based boot — init loads servers from storage via IPC, VirtIO GPU driver

Complete microkernel boot pipeline: adapter loads only init + storage + display
from disk. Init bootstraps all other servers by reading binaries from the
storage server via IPC, parsing ELF, creating processes, mapping pages, and
spawning threads.

New syscalls:
- CreateEndpoint: userspace endpoint creation with full capability grant
- DebugPutchar: debug output to UART from userspace
- MapPage: cross-process page mapping (init loads binaries into children)
- SpawnThreadIn: spawn thread in another process via capability

Key fixes:
- Per-process L1 page tables for VPN[2]=0 (prevents cross-process corruption)
- Separate kernel_pt from page_tables[0] (init pid=0 overwrote kernel PT ref)
- Thread Running state set in switch_to_next (syscalls rejected without it)
- Pending IPC results applied during context switch
- SIE disabled during boot (timer can't preempt into unready processes)
- User heap VA starts at 0x40000 (avoids shared buffer at 0x30000)
- RequestPages maps at user VAs via per-process heap allocator

VirtIO GPU:
- Adapter probes for GPU device, initializes resource/scanout/backing
- Display server writes to mapped framebuffer, flushes via GPU virtqueue
- 640x480 BGRA framebuffer with transfer-to-host and resource-flush

Storage server:
- Userspace VirtIO block driver using pre-mapped MMIO and DMA pages
- FAT16 filesystem reader serving file-read requests via IPC
- Shared buffer protocol: init writes filename, storage writes file data

Echo app for IPC testing (adapter-loaded echo proved the pipeline end-to-end).

crates/kernel/src/syscall/mod.rs

@@ -55,6 +55,14 @@ impl<P: Platform> Kernel<P> {
             Syscall::AcknowledgeInterrupt { irq } => self.handle_ack_interrupt(pid, irq),
             Syscall::WaitAny { sources } => self.handle_wait_any(tid, pid, sources),
             Syscall::Halt => self.handle_halt(pid),
+            Syscall::CreateEndpoint => self.handle_create_endpoint(pid),
+            Syscall::DebugPutchar { byte } => self.handle_debug_putchar(byte),
+            Syscall::MapPage { process, src_va, dst_va, executable } => {
+                self.handle_map_page(pid, process, src_va, dst_va, executable)
+            }
+            Syscall::SpawnThreadIn { process, entry, stack } => {
+                self.handle_spawn_thread_in(pid, process, entry, stack)
+            }
         }
     }
 }