refactor: apply newtypes throughout userspace API and display types

Every syscall stub now uses proper types from types/ — CapSlot,
EntryPoint, StackPointer, VirtualAddress, PageCount, ProcessId,
PermissionSet, Ticks. The compiler prevents swapping entry/stack,
passing a ProcessId where a CapSlot is expected, or using an
address as a page count.

New display types in types/display.rs:
  - Color(u32) with rgb() constructor
  - ScreenCoord(u16) for x/y positions
  - Dimension(u16) for width/height

Updated throughout:
  - userspace/syscall.rs: all params typed, returns Option instead
    of sentinel usize::MAX
  - server-framework: endpoint param is CapSlot
  - port-framebuffer: trait uses Color, ScreenCoord, Dimension
  - hw-virtio: DmaAddrs uses PhysicalAddress/VirtualAddress,
    GPU commands use Dimension
  - All servers, drivers, bins, apps updated for new signatures
  - permission-manager: process field uses ProcessId
  - PermissionSet: added bits() accessor

89 tests pass, full QEMU boot verified.

crates/servers/permission-manager/src/server.rs

@@ -1,4 +1,5 @@
 use server_framework::Server;
+use types::id::ProcessId;
 
 use crate::protocol::{CapabilityKind, PermissionRequest, PermissionResponse};
 
@@ -16,8 +17,8 @@ impl PermissionManager {
         }
     }
 
-    fn granted_bits(&self, process: u16) -> u16 {
-        let idx = process as usize;
+    fn granted_bits(&self, process: ProcessId) -> u16 {
+        let idx = process.raw() as usize;
         if idx >= MAX_PROCESSES {
             return 0;
         }
@@ -38,7 +39,7 @@ impl Server for PermissionManager {
     fn handle(&mut self, request: PermissionRequest) -> PermissionResponse {
         match request {
             PermissionRequest::RequestCapability { process, kind } => {
-                let idx = process as usize;
+                let idx = process.raw() as usize;
                 if idx >= MAX_PROCESSES {
                     return PermissionResponse::Denied;
                 }
@@ -46,7 +47,7 @@ impl Server for PermissionManager {
                 PermissionResponse::Granted
             }
             PermissionRequest::RevokeCapability { process, kind } => {
-                let idx = process as usize;
+                let idx = process.raw() as usize;
                 if idx >= MAX_PROCESSES {
                     return PermissionResponse::Denied;
                 }
@@ -54,7 +55,7 @@ impl Server for PermissionManager {
                 PermissionResponse::Revoked
             }
             PermissionRequest::CheckCapability { process, kind } => {
-                let idx = process as usize;
+                let idx = process.raw() as usize;
                 if idx >= MAX_PROCESSES {
                     return PermissionResponse::HasCapability(false);
                 }