refactor: apply newtypes throughout userspace API and display types

Every syscall stub now uses proper types from types/ — CapSlot,
EntryPoint, StackPointer, VirtualAddress, PageCount, ProcessId,
PermissionSet, Ticks. The compiler prevents swapping entry/stack,
passing a ProcessId where a CapSlot is expected, or using an
address as a page count.

New display types in types/display.rs:
  - Color(u32) with rgb() constructor
  - ScreenCoord(u16) for x/y positions
  - Dimension(u16) for width/height

Updated throughout:
  - userspace/syscall.rs: all params typed, returns Option instead
    of sentinel usize::MAX
  - server-framework: endpoint param is CapSlot
  - port-framebuffer: trait uses Color, ScreenCoord, Dimension
  - hw-virtio: DmaAddrs uses PhysicalAddress/VirtualAddress,
    GPU commands use Dimension
  - All servers, drivers, bins, apps updated for new signatures
  - permission-manager: process field uses ProcessId
  - PermissionSet: added bits() accessor

89 tests pass, full QEMU boot verified.

crates/server-framework/src/async_syscall/mod.rs

@@ -1,15 +1,16 @@
-pub async fn send(endpoint: usize, w0: usize, w1: usize, w2: usize, w3: usize) -> usize {
+use types::bounded::CapSlot;
+
+pub async fn send(endpoint: CapSlot, w0: usize, w1: usize, w2: usize, w3: usize) -> usize {
     userspace::syscall::send(endpoint, w0, w1, w2, w3)
 }
 
-pub async fn receive(endpoint: usize) -> (usize, usize, usize, usize) {
+pub async fn receive(endpoint: CapSlot) -> (usize, usize, usize, usize) {
     userspace::syscall::receive(endpoint)
 }
 
-pub async fn wait_for_interrupt(irq: usize) {
+pub async fn wait_for_interrupt(_irq: CapSlot) {
     userspace::syscall::yield_now();
 }
 
-pub async fn acknowledge_interrupt(irq: usize) {
-    let _ = irq;
+pub async fn acknowledge_interrupt(_irq: CapSlot) {
 }