feat: kernel memory plugin + unified source menu + driver improvements

- KernelMemory plugin: kernel-mode process/physical memory R/W via IOCTL driver
- rcxdrv.sys: MmCopyMemory for reads, MDL mapping with correct cache types
  (MmCached for RAM, MmNonCached for MMIO only — fixes cache corruption BSOD)
- Driver reconnect: ensureDriverLoaded tries device handle first, no auto
  stop+delete cycle. Manual unload closes handle only, service stays running.
- Unified source menu: ProviderRegistry::populateSourceMenu() shared by both
  main window Data Source menu and RcxEditor inline picker (icons + dll names)
- IProviderPlugin::populatePluginMenu() for conditional plugin actions
  (e.g. "Unload Kernel Driver" only when loaded)
- Physical memory mode removed from selectTarget (access via context menu only)
- requestOpenProviderTab sets base address from provider after template load
- Address parser: vtop(), cr3(), physRead() callbacks for kernel paging expressions

src/addressparser.cpp

@@ -273,6 +273,7 @@ private:
     // Identifier or hex literal disambiguation.
     // Scan [a-zA-Z_][a-zA-Z0-9_]*. If it contains any non-hex char → identifier.
     // Otherwise → backtrack and parse as hex number.
+    // If the identifier is followed by '(', try to parse as a built-in function call.
     bool parseIdentifierOrHex(uint64_t& result) {
         int start = m_pos;
         bool hasNonHex = false;
@@ -292,6 +293,11 @@ private:
             return parseHexNumber(result);
         }
 
+        // Check for function call syntax: identifier '(' args ')'
+        skipSpaces();
+        if (peek() == '(')
+            return parseFunctionCall(token, result);
+
         // It's an identifier — resolve via callback
         if (!m_callbacks || !m_callbacks->resolveIdentifier) {
             result = 0;
@@ -305,6 +311,71 @@ private:
         return true;
     }
 
+    // Built-in function call: vtop(pid, va), cr3(pid), phys(addr)
+    bool parseFunctionCall(const QString& name, uint64_t& result) {
+        advance(); // skip '('
+
+        if (name == QStringLiteral("vtop")) {
+            // vtop(pid, virtualAddress) → physical address
+            uint64_t pid = 0;
+            if (!parseBitwiseOr(pid)) return false;
+            skipSpaces();
+            if (peek() != ',')
+                return fail("vtop() requires 2 arguments: vtop(pid, va)");
+            advance(); // skip ','
+            uint64_t va = 0;
+            if (!parseBitwiseOr(va)) return false;
+            if (!expect(')')) return false;
+
+            if (!m_callbacks || !m_callbacks->vtop) {
+                result = 0;
+                return true;
+            }
+            bool ok = false;
+            result = m_callbacks->vtop((uint32_t)pid, va, &ok);
+            if (!ok)
+                return fail(QStringLiteral("vtop(0x%1, 0x%2) failed")
+                    .arg(pid, 0, 16).arg(va, 0, 16));
+            return true;
+        }
+
+        if (name == QStringLiteral("cr3")) {
+            // cr3(pid) → CR3 value
+            uint64_t pid = 0;
+            if (!parseBitwiseOr(pid)) return false;
+            if (!expect(')')) return false;
+
+            if (!m_callbacks || !m_callbacks->cr3) {
+                result = 0;
+                return true;
+            }
+            bool ok = false;
+            result = m_callbacks->cr3((uint32_t)pid, &ok);
+            if (!ok)
+                return fail(QStringLiteral("cr3(%1) failed").arg(pid));
+            return true;
+        }
+
+        if (name == QStringLiteral("phys")) {
+            // phys(addr) → read 8 bytes from physical address
+            uint64_t addr = 0;
+            if (!parseBitwiseOr(addr)) return false;
+            if (!expect(')')) return false;
+
+            if (!m_callbacks || !m_callbacks->physRead) {
+                result = 0;
+                return true;
+            }
+            bool ok = false;
+            result = m_callbacks->physRead(addr, &ok);
+            if (!ok)
+                return fail(QStringLiteral("phys(0x%1) failed").arg(addr, 0, 16));
+            return true;
+        }
+
+        return fail(QStringLiteral("unknown function '%1'").arg(name));
+    }
+
     // '[' bitwiseOr ']' — read the pointer value at the computed address
     bool parseDereference(uint64_t& result) {
         advance(); // skip '['