refactor: apply newtypes throughout userspace API and display types

Every syscall stub now uses proper types from types/ — CapSlot,
EntryPoint, StackPointer, VirtualAddress, PageCount, ProcessId,
PermissionSet, Ticks. The compiler prevents swapping entry/stack,
passing a ProcessId where a CapSlot is expected, or using an
address as a page count.

New display types in types/display.rs:
  - Color(u32) with rgb() constructor
  - ScreenCoord(u16) for x/y positions
  - Dimension(u16) for width/height

Updated throughout:
  - userspace/syscall.rs: all params typed, returns Option instead
    of sentinel usize::MAX
  - server-framework: endpoint param is CapSlot
  - port-framebuffer: trait uses Color, ScreenCoord, Dimension
  - hw-virtio: DmaAddrs uses PhysicalAddress/VirtualAddress,
    GPU commands use Dimension
  - All servers, drivers, bins, apps updated for new signatures
  - permission-manager: process field uses ProcessId
  - PermissionSet: added bits() accessor

89 tests pass, full QEMU boot verified.

crates/userspace/src/allocator/mod.rs

@@ -47,14 +47,18 @@ impl AllocatorInner {
             return ptr::null_mut();
         }
 
-        let page_addr = crate::syscall::request_pages(1);
-        if page_addr == usize::MAX {
-            return ptr::null_mut();
-        }
+        let count = match types::bounded::PageCount::new(1) {
+            Some(c) => c,
+            None => return ptr::null_mut(),
+        };
+        let va = match crate::syscall::request_pages(count) {
+            Some(va) => va,
+            None => return ptr::null_mut(),
+        };
 
-        self.pages[self.page_count] = page_addr;
+        self.pages[self.page_count] = va.raw();
         self.page_count += 1;
-        page_addr as *mut u8
+        va.raw() as *mut u8
     }
 
     fn alloc_from_free_list(&mut self, size: usize, align: usize) -> *mut u8 {