Service manager step 2: Timer resource (mailbox-integrated one-shot timers)

## Summary

Implement a mailbox-integrated one-shot timer resource (`EVENT_TIMER`) that posts events to userspace mailboxes when a deadline expires. This extends the existing `DeadlineTracker`/APIC timer infrastructure.

This is step 2 of the service manager implementation (#26). The service manager needs timers for restart backoff delays and stop grace periods.

## Current state

- The kernel has `DeadlineTracker` and APIC timer infrastructure for internal scheduling
- Mailboxes support event aggregation from multiple sources
- No mechanism for userspace to request a timed callback/event

## Desired behaviour

- Userspace creates a timer resource and registers it with a mailbox
- Setting a deadline on the timer causes an `EVENT_TIMER` to be posted to the mailbox when the deadline expires
- One-shot semantics: the timer fires once and must be re-armed explicitly
- Timer can be cancelled before it fires

## Key files

- `panda-abi/src/lib.rs` — add `EVENT_TIMER` constant and timer-related opcodes
- `panda-kernel/src/resources/` — new timer resource type
- `panda-kernel/src/timer/` or `DeadlineTracker` — hook into APIC timer expiry
- `libpanda/src/` — high-level `Timer` wrapper with `set_deadline()`, `cancel()`

## Testing

- Kernel test: create timer, set short deadline, verify event arrives on mailbox
- Kernel test: create timer, cancel before deadline, verify no event
- Userspace test: set a timer and wait on mailbox, verify it fires
- Userspace test: multiple timers on the same mailbox, verify ordering

## Documentation

- Doc comments on timer resource API
- Document interaction with mailbox event model in `docs/IPC.md`

Part of #26

Start by reading panda-abi/src/lib.rs, the existing resources under panda-kernel/src/resources/, and the DeadlineTracker/APIC timer path. Trace how mailbox events are represented before designing the timer resource and libpanda/src/Timer wrapper. Done means one-shot timers can be armed, cancelled, and re-armed, with kernel and userspace tests covering mailbox delivery, cancellation, and ordering, plus docs/IPC.md updates.

Written by the indexing model from the issue text.