refactor: apply newtypes throughout userspace API and display types

Every syscall stub now uses proper types from types/ — CapSlot,
EntryPoint, StackPointer, VirtualAddress, PageCount, ProcessId,
PermissionSet, Ticks. The compiler prevents swapping entry/stack,
passing a ProcessId where a CapSlot is expected, or using an
address as a page count.

New display types in types/display.rs:
  - Color(u32) with rgb() constructor
  - ScreenCoord(u16) for x/y positions
  - Dimension(u16) for width/height

Updated throughout:
  - userspace/syscall.rs: all params typed, returns Option instead
    of sentinel usize::MAX
  - server-framework: endpoint param is CapSlot
  - port-framebuffer: trait uses Color, ScreenCoord, Dimension
  - hw-virtio: DmaAddrs uses PhysicalAddress/VirtualAddress,
    GPU commands use Dimension
  - All servers, drivers, bins, apps updated for new signatures
  - permission-manager: process field uses ProcessId
  - PermissionSet: added bits() accessor

89 tests pass, full QEMU boot verified.

crates/ports/framebuffer/src/lib.rs

@@ -1,10 +1,12 @@
 #![no_std]
 
+use types::display::{Color, Dimension, ScreenCoord};
+
 pub trait Framebuffer {
-    fn width(&self) -> u16;
-    fn height(&self) -> u16;
-    fn write_pixel(&mut self, x: u16, y: u16, color: u32);
-    fn fill_rect(&mut self, x: u16, y: u16, w: u16, h: u16, color: u32);
-    fn clear(&mut self, color: u32);
+    fn width(&self) -> Dimension;
+    fn height(&self) -> Dimension;
+    fn write_pixel(&mut self, x: ScreenCoord, y: ScreenCoord, color: Color);
+    fn fill_rect(&mut self, x: ScreenCoord, y: ScreenCoord, w: Dimension, h: Dimension, color: Color);
+    fn clear(&mut self, color: Color);
     fn flush(&mut self);
 }