feat(docker): eBPF stateful packet filters on kernel links

Consume the eBPF impairment classifier delivered in uBridge
feature/tc-precision: frequency_drop becomes the exact every-Nth mode
(tc nth_drop; -1 = drop everything maps to every 1st) and the new
kernel-only quota type is the byte-cap mode (tc quota_drop, 100 = hard
cutoff). KERNEL_UNSUPPORTED_FILTERS is gone entirely — kernel/relay
eligibility is now purely topological. Both modes gate on ebpf=1 from
the per-process tc capabilities probe (error names the setcap fix); the
cleanup path (modes off) only talks to the eBPF commands when the probe
reported them. Reconcile is a plain re-set: the netem reset-before-set
already detaches the program and clears uBridge's per-interface
registry, so a mode set after it is a fresh load+attach.

Documented semantic difference: the relay counts both directions
through one bridge counter, the kernel counts per direction — N=3
round-trip loss is 1-(2/3)^2 = 55.6% on kernel vs ~1/N on relay
(measured 57%). window_drop is NOT exposed: the delivered
implementation advances the window with no gap, making 'outside the
window packets pass' unreachable (needs outage/period fields —
recorded in the spec); flow_drop awaits a parameter-shape decision.

Also fixes a pre-existing restart bug the e2e exposed: _bridges (relay
bridge names) was never cleared on stop, so restarting a node with a
relay link skipped 'bridge create' and failed on add_nio_udp.

e2e (isolated instance): 13/13 — pref-1 tc_impair classifier on both
veths, 57% round-trip for N=3, -1 = exact 100%, quota hard cutoff,
delay coexistence, clean teardown, suspend/resume, node restart,
relay-leg frequency_drop regression through an Ethernet switch. Full
suite: 1925 passed.

gns3server/controller/link.py

@@ -46,7 +46,8 @@ FILTERS = [
     {
         "type": "frequency_drop",
         "name": "Frequency drop",
-        "description": "It will drop everything with a -1 frequency, drop every Nth packet with a positive frequency, or drop nothing",
+        "description": "It will drop everything with a -1 frequency, drop every Nth packet with a positive "
+        "frequency, or drop nothing. On kernel-datapath links this is exact (eBPF every-Nth counter)",
         "parameters": [{"name": "Frequency", "minimum": -1, "maximum": 32767, "type": "int", "unit": "th packet"}],
     },
     {
@@ -136,6 +137,16 @@ FILTERS = [
         "combining a low rate with a long delay (kernel-datapath links only)",
         "parameters": [{"name": "Limit", "minimum": 1, "maximum": 1000000, "type": "int", "unit": "packets"}],
     },
+    {
+        "type": "quota",
+        "name": "Byte quota",
+        "description": "After the byte quota is consumed, each further packet drops with the given chance "
+        "(100 = hard cutoff) — a data cap, like a mobile plan (kernel-datapath links only)",
+        "parameters": [
+            {"name": "Quota", "minimum": 1, "maximum": 1000000000000000, "type": "int", "unit": "bytes"},
+            {"name": "Chance", "minimum": 0, "maximum": 100, "type": "int", "unit": "%"},
+        ],
+    },
 ]
 
 
@@ -296,24 +307,12 @@ class Link:
         except FilterValidationError as e:
             raise ControllerError(f"Invalid packet filter parameters: {e!s}")
 
-        if self.kernel_datapath:
-            from gns3server.utils.packet_filter_validation import KERNEL_UNSUPPORTED_FILTERS
-
-            unsupported = KERNEL_UNSUPPORTED_FILTERS.intersection(new_filters or {})
-            if unsupported:
-                raise ControllerError(
-                    "Packet filter(s) {} cannot run on a kernel-datapath link (no uBridge relay "
-                    "in the forwarding path; delay, packet loss and corrupt are served by tc "
-                    "netem on the veth); delete and recreate the link to use them".format(
-                        ", ".join(sorted(unsupported))
-                    )
-                )
-        elif self._created:
-            # The reverse guard: netem-extension filters have no relay
-            # equivalent. Only enforced on created links — while loading a
-            # project the datapath is not decided yet (a link that will be
-            # wired on the kernel datapath must accept them), and the relay
-            # prepare path drops what it cannot run with a warning.
+        if self._created and not self.kernel_datapath:
+            # Kernel-only filters (the netem extensions, the eBPF quota mode)
+            # have no relay equivalent. Only enforced on created links — while
+            # loading a project the datapath is not decided yet (a link that
+            # will be wired on the kernel datapath must accept them), and the
+            # relay prepare path drops what it cannot run with a warning.
             conflicts = kernel_only_features(new_filters)
             if conflicts:
                 raise ControllerError(
@@ -722,13 +721,11 @@ class Link:
         filter_node = self._get_filter_node()
         if filter_node:
             if self.kernel_datapath:
-                # Kernel-datapath links serve filters via tc netem on the
-                # veth host end; types without a netem equivalent (which
-                # only run in the uBridge relay) are hidden from the picker.
-                from gns3server.utils.packet_filter_validation import KERNEL_UNSUPPORTED_FILTERS
-
-                return [f for f in FILTERS if f["type"] not in KERNEL_UNSUPPORTED_FILTERS]
-            # Relay links: hide the netem-extension types the relay cannot run
+                # Kernel-datapath links serve every filter type: netem for
+                # delay/loss/corrupt and the netem extensions, cls_bpf for
+                # bpf, the eBPF classifier for frequency_drop and quota.
+                return FILTERS
+            # Relay links: hide the kernel-only types the relay cannot run
             # (they would be rejected with 409 on update).
             from gns3server.utils.packet_filter_validation import KERNEL_ONLY_FILTERS