Safe DMA transfer API: ownership-based framebuffer locking

[leftger]

Closes #30.

Summary

• DisplayBackend::start_dma_transfer now takes FrameBuf by value and returns a DmaTransfer token
• The buffer is locked inside the token until DmaTransfer::wait(self) returns it — the compiler makes concurrent access impossible
• SwapChain is restructured with a FrontState<FB, Xfer> enum (Idle / InFlight) so the front buffer is always either owned by the swap chain or owned by the transfer token, never both
• SimulatorBackend gains a CompletedTransfer<FB> type (immediately done, zero hardware cost)
• TripleSwapChain follows the same pattern
• All existing call sites (present, try_present, get_back_buffer, dma_rendering_demo.rs) are unchanged

Migration guide for DisplayBackend implementors

Before:
```rust
fn start_dma_transfer(&mut self, framebuffer: &FrameBuf<Rgb565, FB>) -> Result<(), DisplayError>;
fn wait_for_dma(&mut self);
fn is_dma_ready(&self) -> bool;
```

After:
```rust
type Transfer: DmaTransfer<Buffer = FrameBuf<Rgb565, FB>>;

fn start_dma_transfer(
&mut self,
framebuffer: FrameBuf<Rgb565, FB>, // by value, not by reference
) -> Result<Self::Transfer, TransferError>; // return token, not ()
```

Implement DmaTransfer for your transfer type:
```rust
impl DmaTransfer for MyTransfer {
type Buffer = FrameBuf<Rgb565, MyFB>;
fn is_done(&self) -> bool { /* poll DMA done flag */ }
fn wait(self) -> FrameBuf<Rgb565, MyFB> {
while !self.is_done() {}
self.framebuffer
}
}
```

Implement Drop on your transfer type to cancel DMA if the token is dropped before wait is called.

Test plan

• cargo test passes (46 tests without physics, 50 with --features physics)
• cargo test --features triple-buffering passes
• cargo check --example dma_rendering_demo --features std passes with no changes to the example

Made with Cursor