refactor: apply newtypes throughout userspace API and display types

Every syscall stub now uses proper types from types/ — CapSlot,
EntryPoint, StackPointer, VirtualAddress, PageCount, ProcessId,
PermissionSet, Ticks. The compiler prevents swapping entry/stack,
passing a ProcessId where a CapSlot is expected, or using an
address as a page count.

New display types in types/display.rs:
  - Color(u32) with rgb() constructor
  - ScreenCoord(u16) for x/y positions
  - Dimension(u16) for width/height

Updated throughout:
  - userspace/syscall.rs: all params typed, returns Option instead
    of sentinel usize::MAX
  - server-framework: endpoint param is CapSlot
  - port-framebuffer: trait uses Color, ScreenCoord, Dimension
  - hw-virtio: DmaAddrs uses PhysicalAddress/VirtualAddress,
    GPU commands use Dimension
  - All servers, drivers, bins, apps updated for new signatures
  - permission-manager: process field uses ProcessId
  - PermissionSet: added bits() accessor

89 tests pass, full QEMU boot verified.

crates/bins/display-qemu/src/main.rs

@@ -4,11 +4,13 @@
 extern crate userspace_rt;
 
 use driver_framebuffer_virtio::VirtioFramebuffer;
+use types::bounded::CapSlot;
 
 #[unsafe(no_mangle)]
 extern "C" fn main() {
     let fb = VirtioFramebuffer::new();
     let mut srv = display_server::server::DisplayServer::new(fb);
-    server_framework::serve(&mut srv, 0);
+    let ep = CapSlot::new(0).unwrap();
+    server_framework::serve(&mut srv, ep);
     loop { userspace::syscall::yield_now(); }
 }