refactor: apply newtypes throughout userspace API and display types

Every syscall stub now uses proper types from types/ — CapSlot,
EntryPoint, StackPointer, VirtualAddress, PageCount, ProcessId,
PermissionSet, Ticks. The compiler prevents swapping entry/stack,
passing a ProcessId where a CapSlot is expected, or using an
address as a page count.

New display types in types/display.rs:
  - Color(u32) with rgb() constructor
  - ScreenCoord(u16) for x/y positions
  - Dimension(u16) for width/height

Updated throughout:
  - userspace/syscall.rs: all params typed, returns Option instead
    of sentinel usize::MAX
  - server-framework: endpoint param is CapSlot
  - port-framebuffer: trait uses Color, ScreenCoord, Dimension
  - hw-virtio: DmaAddrs uses PhysicalAddress/VirtualAddress,
    GPU commands use Dimension
  - All servers, drivers, bins, apps updated for new signatures
  - permission-manager: process field uses ProcessId
  - PermissionSet: added bits() accessor

89 tests pass, full QEMU boot verified.

crates/apps/echo/src/main.rs

@@ -3,14 +3,13 @@
 
 extern crate userspace_rt;
 
+use types::bounded::CapSlot;
 use userspace::syscall;
 
 #[unsafe(no_mangle)]
 extern "C" fn main() {
-    // Cap slot 0 = endpoint cap (granted by adapter at boot)
-    let ep: usize = 0;
+    let ep = CapSlot::new(0).unwrap();
 
-    // Receive a message, echo it back with word0 incremented
     let (w0, w1, w2, w3) = syscall::receive(ep);
     syscall::send(ep, w0.wrapping_add(1), w1, w2, w3);