refactor: extract shared hw-virtio crate, eliminate VirtIO protocol duplication

Two VirtIO block and two VirtIO GPU implementations (adapter + driver)
shared 90% of their protocol logic. Extracted the common code into
hw-virtio, parameterized by MmioAccess trait.

New crate: hw-virtio (no_std, zero deps)
  - mmio.rs: MmioAccess trait, DirectMmio, init_legacy_device(), scan
  - queue.rs: VirtioQueue with descriptor chain submit + poll
  - block.rs: block read protocol (3-descriptor chain)
  - gpu.rs: GPU commands (create_2d, attach_backing, set_scanout,
            transfer_to_host, resource_flush)

Adapter thin wrappers (identity-mapped, statics for DMA):
  - virtio_blk.rs: 220 → 53 lines
  - virtio_gpu.rs: 165 → 37 lines

Driver thin wrappers (mapped VAs, phys-info for DMA):
  - drivers/block/virtio: 139 → 70 lines
  - drivers/framebuffer/virtio: 146 → 95 lines

Also deleted input-server/input_device.rs (1-line re-export,
superseded by port-input-device).

Cargo.toml

@@ -49,6 +49,7 @@ members = [
     "crates/drivers/block/virtio",
     "crates/bins/display-qemu",
     "crates/bins/storage-qemu",
+    "crates/hw-virtio",
 ]
 resolver = "2"
 
@@ -92,6 +93,9 @@ telephony-server = { path = "crates/servers/telephony-server" }
 usb-server = { path = "crates/servers/usb-server" }
 user-manager = { path = "crates/servers/user-manager" }
 
+# hw
+hw-virtio = { path = "crates/hw-virtio" }
+
 # ports
 port-framebuffer = { path = "crates/ports/framebuffer" }
 port-block-device = { path = "crates/ports/block-device" }