reorg: move test fixtures to test/system/services (source + boot volume)

The 11 QEMU-suite fixtures lived mixed into system/services/ with their
binaries bundled at /system/tests/<name>. Now the repo path is the boot
path, like every real service: test/system/services/<name>. fat-test
moves out of the fat server's directory into its own; display-demo
stays a boot service.

- kernel VFS: setInitialRamdisk derives one read-only initrd mount per
  top-level tree named by the ramdisk entry paths (/system, /test),
  registers ancestors generically with self-parented roots, and refuses
  backend shadowing of any initrd tree
- EFI loader: the fallback walk also enumerates \test (optional — a
  volume without fixtures still boots); manifest and capsule unchanged
- path literals: vfs-test self-open + create probe, process-test
  process_enumerate matches, the args-echo argv[0] expectation; the
  kvfs case now covers the /test root end to end
- docs: DFHS /test rows, tree diagrams, loader prose, and the location
  convention gain the third home; fixed the input-source link

100/100 QEMU cases pass.

test/system/services/input-test/input-test.zig

@@ -0,0 +1,50 @@
+//! test/system/services/input-test — the input service's client and test oracle, the input
+//! counterpart of vfs-test. It subscribes to *all* device classes and loops receiving the
+//! events a source broadcasts, logging each with its class. It emits the success marker
+//! `"input-test: ok"` only **after it has received at least one of each class** (keyboard,
+//! mouse, and joystick), then heartbeats it. So the in-kernel `input` test case seeing that
+//! marker proves not just that IPC delivery works but that the service *routed* all three
+//! device classes to one subscription — source -> service -> subscriber, per device.
+
+const std = @import("std");
+const input = @import("input");
+const logging = @import("logging");
+
+fn writeLine(comptime fmt: []const u8, arguments: anytype) void {
+    var line: [128]u8 = undefined;
+    _ = logging.write(std.fmt.bufPrint(&line, fmt, arguments) catch return);
+}
+
+pub fn main() void {
+    var listener = input.subscribeAll() orelse {
+        _ = logging.write("input-test: could not subscribe\n");
+        return;
+    };
+    _ = logging.write("input-test: subscribed\n");
+
+    var seen_keyboard = false;
+    var seen_mouse = false;
+    var seen_joystick = false;
+    while (true) {
+        const event = listener.next() orelse continue;
+        // Decode the class-specific payload from the tagged envelope and note the class.
+        if (event.asKeyboard()) |key| {
+            seen_keyboard = true;
+            writeLine("input-test: got keyboard code={d} char={d}\n", .{ key.keycode, key.character });
+        } else if (event.asMouse()) |mouse| {
+            seen_mouse = true;
+            writeLine("input-test: got mouse dx={d} dy={d} buttons={d}\n", .{ mouse.dx, mouse.dy, mouse.buttons });
+        } else if (event.asJoystick()) |joystick| {
+            seen_joystick = true;
+            writeLine("input-test: got joystick control={d} value={d}\n", .{ joystick.control, joystick.value });
+        } else {
+            writeLine("input-test: got device={d}\n", .{event.device});
+        }
+
+        // The success marker: only once every class has been routed here does this appear,
+        // and then it heartbeats. Seeing "input-test: ok" proves per-device fan-out works.
+        if (seen_keyboard and seen_mouse and seen_joystick) {
+            _ = logging.write("input-test: ok all classes received (keyboard, mouse, joystick)\n");
+        }
+    }
+}