feat(mmc5): implement MMC5 mapper with accurate scanline IRQ and CHR banking

- Add ExRAM (modes 0-1) and fill-mode nametable routing via
  read_nametable_byte / write_nametable_byte mapper hooks
- Separate sprite and BG CHR bank sets ($5120-$5127 vs $5128-$512B);
  BG banks are only active in 8x16 sprite mode
- Use mapper.ppu_read_sprite() for sprite tile loads so they always
  use the sprite bank set regardless of PPU fetch phase
- Replace CPU-cycle IRQ stub with scanline-based counter matching
  Mesen2 hardware behaviour: fire when counter == irq_scanline at
  dot 2 (start of scanline), irq_scanline=0 never fires
- Add Mapper::notify_frame_start() called unconditionally at the PPU
  frame boundary; MMC5 uses it to hard-reset the scanline counter even
  when rendering is disabled (e.g. during room transitions), preventing
  stale counter values from shifting the CHR split by 8+ scanlines
- Fix CHR bank calculation for modes 0-2: use << 3/2/1 shifts instead
  of & !7/3/1 masking to correctly convert bank numbers to 1KB indices
- Correct $5204 read: bit 7 = IRQ pending (cleared on read), bit 6 =
  in-frame flag; IRQ line stays asserted until $5204 is read
- Dispatch $4020-$5FFF CPU reads/writes to mapper cpu_read_low /
  cpu_write_low so MMC5 internal registers are accessible

src/native_core/mapper/mappers/mapper118.rs

@@ -21,7 +21,7 @@ impl Mapper for InesMapper118 {
         self.mmc3.cpu_write(addr, value);
     }
 
-    fn cpu_read_low(&self, addr: u16) -> Option<u8> {
+    fn cpu_read_low(&mut self, addr: u16) -> Option<u8> {
         self.mmc3.cpu_read_low(addr)
     }