refactor: apply newtypes throughout userspace API and display types

Every syscall stub now uses proper types from types/ — CapSlot,
EntryPoint, StackPointer, VirtualAddress, PageCount, ProcessId,
PermissionSet, Ticks. The compiler prevents swapping entry/stack,
passing a ProcessId where a CapSlot is expected, or using an
address as a page count.

New display types in types/display.rs:
  - Color(u32) with rgb() constructor
  - ScreenCoord(u16) for x/y positions
  - Dimension(u16) for width/height

Updated throughout:
  - userspace/syscall.rs: all params typed, returns Option instead
    of sentinel usize::MAX
  - server-framework: endpoint param is CapSlot
  - port-framebuffer: trait uses Color, ScreenCoord, Dimension
  - hw-virtio: DmaAddrs uses PhysicalAddress/VirtualAddress,
    GPU commands use Dimension
  - All servers, drivers, bins, apps updated for new signatures
  - permission-manager: process field uses ProcessId
  - PermissionSet: added bits() accessor

89 tests pass, full QEMU boot verified.

crates/servers/session-server/src/lib.rs

@@ -8,8 +8,10 @@ pub mod server;
 mod tests;
 
 pub fn run() -> ! {
-    let mut srv = server::SessionServer::new(0, 0, 0);
+    let create_cap = types::bounded::CapSlot::new(0).unwrap();
+    let mut srv = server::SessionServer::new(create_cap);
     srv.register_app("snake", "/apps/snake.elf");
-    server_framework::serve(&mut srv, 0);
+    let ep = types::bounded::CapSlot::new(0).unwrap();
+    server_framework::serve(&mut srv, ep);
     loop { userspace::syscall::yield_now(); }
 }

crates/servers/session-server/src/server.rs

@@ -1,4 +1,6 @@
 use server_framework::Server;
+use types::bounded::CapSlot;
+use types::id::ProcessId;
 
 use crate::protocol::{AppId, SessionRequest, SessionResponse};
 
@@ -14,7 +16,7 @@ pub struct AppEntry {
 #[derive(Clone, Copy)]
 struct RunningApp {
     app: AppId,
-    pid: u16,
+    pid: ProcessId,
 }
 
 pub struct SessionServer {
@@ -22,21 +24,17 @@ pub struct SessionServer {
     app_count: usize,
     running: [Option<RunningApp>; MAX_APPS],
     active: Option<AppId>,
-    create_cap: usize,
-    display_cap: usize,
-    input_cap: usize,
+    create_cap: CapSlot,
 }
 
 impl SessionServer {
-    pub fn new(create_cap: usize, display_cap: usize, input_cap: usize) -> Self {
+    pub fn new(create_cap: CapSlot) -> Self {
         Self {
             apps: [const { None }; MAX_APPS],
             app_count: 0,
             running: [const { None }; MAX_APPS],
             active: None,
             create_cap,
-            display_cap,
-            input_cap,
         }
     }
 
@@ -74,9 +72,13 @@ impl SessionServer {
             None => return SessionResponse::NotFound,
         };
 
-        let pid = userspace::syscall::create_process(self.create_cap);
+        let process_cap = match userspace::syscall::create_process(self.create_cap) {
+            Some(cap) => cap,
+            None => return SessionResponse::Error,
+        };
 
-        self.running[idx] = Some(RunningApp { app, pid: pid as u16 });
+        let pid = ProcessId::from_raw(process_cap.value() as u16);
+        self.running[idx] = Some(RunningApp { app, pid });
         self.active = Some(app);
 
         SessionResponse::Launched { app }
@@ -85,8 +87,7 @@ impl SessionServer {
     fn kill_app(&mut self, app: AppId) -> SessionResponse {
         let idx = app.raw() as usize;
         match self.running[idx].take() {
-            Some(running) => {
-                let _ = running.pid;
+            Some(_running) => {
                 if self.active == Some(app) {
                     self.active = None;
                 }

crates/servers/session-server/src/tests/server.rs

@@ -3,7 +3,8 @@ use crate::server::SessionServer;
 use server_framework::Server;
 
 fn test_server() -> SessionServer {
-    let mut s = SessionServer::new(0, 0, 0);
+    let cap = types::bounded::CapSlot::new(0).unwrap();
+    let mut s = SessionServer::new(cap);
     s.register_app("snake", "/apps/snake.elf");
     s.register_app("clock", "/apps/clock.elf");
     s