Port I/O grants (io_read / io_write) + refresh stale driver docs

Ring 3 still has no direct in/out (no TSS I/O bitmap, IOPL never raised — a #GP), but a
driver no longer needs it: io_read(device_id, resource_index, offset, width) and
io_write(..., value) grant port access the same way mmio_map grants memory. The claim
plus the device's discovered io_port resource are the capability — resolveIoPort checks
the device is claimed by the caller, the resource is io_port, and [offset, offset+width)
stays inside it, then issues the in/out via architecture.pioRead/pioWrite. So a PS/2 or
16550 driver is now writable; the low-rate legacy hardware that needs port I/O is fine
with a syscall per access. io_port resources were recorded by discovery and ignored —
now they're used. Runtime: device.ioRead/ioWrite.

New `ioport` test claims QEMU's PS/2 controller (io_port 0x64, discovered via ACPI) and
checks the gate admits an in-range access, refuses over-wide / out-of-range / unclaimed,
and that the kernel actually reads the status port (0x1c). Suite 41/41 plus host tests.

Docs refreshed for the whole M13-M16 + port-I/O reality: drivers.md "Limits" no longer
lists port I/O, DMA memory, or barriers as missing (they exist) and its "what's next"
reflects that; the FSH doc's character-device and block-device sections are corrected
("cannot host a block driver at all" is no longer true — writable now, not yet memory-
safe pending IOMMU enforcement); device-interrupts.md unblocks the keyboard and narrows
the interrupt gap to MSI-X.

docs/device-interrupts.md

@@ -156,10 +156,11 @@ spinning in unrelated code — is the whole mechanism working end to end.
 
 ## What's next (not done here)
 
-- **The keyboard**: the PS/2 controller is port-mapped (`0x60`/`0x64`), and ring 3
-  has no port I/O yet, so the first *input* device is blocked on either an I/O
-  permission bitmap or `io_in`/`io_out` syscalls ([drivers.md](drivers.md)).
-- **MSI/MSI-X**: per-device vectors, edge-triggered and unshared, which retire the
-  I/O APIC's mask/ack cycle and its 24-GSI ceiling.
+- **The keyboard**: the PS/2 controller is port-mapped (`0x60`/`0x64`), and port I/O is
+  now available to ring 3 via the claim-gated `io_read`/`io_write` syscalls
+  ([drivers.md](drivers.md)) — so the first *input* device is unblocked; it just needs
+  writing (claim the controller, `irq_bind` GSI 1, read scancodes from `0x60`).
+- **MSI-X**: `msi_bind` gives one per-device edge-triggered vector (M15); MSI-X's
+  multi-vector table (many queues per device, e.g. NVMe) is the remaining extension.
 - **The LAPIC's own page** is still mapped writeback-cacheable like the rest of the
   identity map. QEMU tolerates it; real hardware wants it uncacheable.