fix: ring3 private address space + VTIME timer frequency regression

fix: ring3 private address space + VTIME timer frequency regression

1. **ring3 test: create private address space**
   - Previously, x86_usermode_test_start() mapped user pages at
     0x00400000 and 0x00800000 directly into kernel_as (shared by
     all kernel threads). These pages were never cleaned up on exit.
   - Now creates a private AS via vmm_as_create_kernel_clone(),
     switches to it, then maps user pages there. On process exit,
     vmm_as_destroy() properly frees the pages.
   - Eliminates kernel_as contamination that could interfere with
     other processes (init.elf, /bin/sh).

2. **TTY VTIME: fix hardcoded 50Hz tick rate**
   - tty_read_kbuf() calculated non-canonical VTIME timeout as
     vtime*5 (hardcoded for 50Hz). At 100Hz this gave half the
     intended timeout, causing premature read returns.
   - Now uses vtime*(TIMER_HZ/10) which is correct at any tick rate.

Tests: 20/20 smoke (8s), 16/16 battery, cppcheck clean