feat: add compositor capability

kernel/src/Api/Window.hpp

@@ -45,7 +45,12 @@ namespace montauk::abi {
         return WinServer::Enumerate(outArray, maxCount);
     }
 
+    // Mapping another process's window and injecting input into it are the
+    // compositor's job alone. Left open, any app could read every window's
+    // pixels or click on any window -- including a prompt asking the user
+    // whether to grant that same app authority.
     static uint64_t Sys_WinMap(int windowId) {
+        if (!Sched::HasCapability(CAP_COMPOSITOR)) return 0;
         auto* proc = Sched::GetCurrentProcessPtr();
         if (proc == nullptr) return 0;
         return WinServer::Map(windowId, proc->pid, proc->pml4Phys, proc->heapNext);
@@ -58,6 +63,7 @@ namespace montauk::abi {
     }
 
     static int Sys_WinSendEvent(int windowId, const WinEvent* event) {
+        if (!Sched::HasCapability(CAP_COMPOSITOR)) return SYS_ERR_PERMISSION;
         if (event == nullptr) return -1;
         return WinServer::SendEvent(windowId, event);
     }