feat(docker): packet filters on kernel-datapath links via tc netem

Impairment filters with a netem equivalent (delay, packet_loss, corrupt)
now run on the kernel datapath as one tc netem qdisc per veth host end,
pushed through uBridge's netlink tc module (tc netem set / tc reset).
This removes the relay delay filter's nanosleep bottleneck (upstream

Both link endpoints carry the filters: each end's qdisc egress covers
the traffic entering that container, so every direction is impaired
exactly once -- the same net effect as the relay, where both directions
cross the single filtered bridge.

- controller: eligibility keys on relay-only types (frequency_drop, bpf)
  instead of any filter; kernel links push the real filters (the
  synthetic suspend frequency_drop no longer flips a suspended link to
  relay on reopen/reset); update_filters 409s only relay-only types;
  available_filters hides them on kernel links
- compute: create_nio whitelists netem-capable filter types; the NIO
  update path keeps its own guard (PUT mutates the NIO in place);
  _ubridge_apply_netem translates the filter dict into one atomic
  netem-set (full re-apply IS the reconcile); node restart restores the
  qdisc, link deletion detaches it (the veth survives the link)
- e2e (27/27): delay 100 -> 200.2 ms RTT, atomic replace 50 -> 100.2 ms,
  clear -> baseline, packet_loss 30 -> 48 % round-trip (expected 51 %),
  suspend/resume and node restart keep the qdisc, link delete leaves no
  residual impairment

gns3server/utils/packet_filter_validation.py

@@ -4,7 +4,7 @@ Packet filter parameter validation utilities.
 
 import logging
 import subprocess
-from typing import Any, Dict, List
+from typing import Any, Dict, List, Optional
 
 log = logging.getLogger(__name__)
 
@@ -15,7 +15,13 @@ class FilterValidationError(Exception):
     pass
 
 
-def validate_bpf_syntax(bpf_expression: str) -> Dict[str, Any]:
+# Packet filters with no kernel-datapath equivalent (no tc netem mapping):
+# they only run in the uBridge userspace relay, so a link carrying one is
+# wired on the relay, and adding them to a kernel-datapath link is rejected.
+KERNEL_UNSUPPORTED_FILTERS = frozenset({"frequency_drop", "bpf"})
+
+
+def validate_bpf_syntax(bpf_expression: str) -> Dict[str, Optional[str]]:
     """
     Validate BPF filter expression syntax using tcpdump.