feat(docker): eBPF stateful packet filters on kernel links

Consume the eBPF impairment classifier delivered in uBridge
feature/tc-precision: frequency_drop becomes the exact every-Nth mode
(tc nth_drop; -1 = drop everything maps to every 1st) and the new
kernel-only quota type is the byte-cap mode (tc quota_drop, 100 = hard
cutoff). KERNEL_UNSUPPORTED_FILTERS is gone entirely — kernel/relay
eligibility is now purely topological. Both modes gate on ebpf=1 from
the per-process tc capabilities probe (error names the setcap fix); the
cleanup path (modes off) only talks to the eBPF commands when the probe
reported them. Reconcile is a plain re-set: the netem reset-before-set
already detaches the program and clears uBridge's per-interface
registry, so a mode set after it is a fresh load+attach.

Documented semantic difference: the relay counts both directions
through one bridge counter, the kernel counts per direction — N=3
round-trip loss is 1-(2/3)^2 = 55.6% on kernel vs ~1/N on relay
(measured 57%). window_drop is NOT exposed: the delivered
implementation advances the window with no gap, making 'outside the
window packets pass' unreachable (needs outage/period fields —
recorded in the spec); flow_drop awaits a parameter-shape decision.

Also fixes a pre-existing restart bug the e2e exposed: _bridges (relay
bridge names) was never cleared on stop, so restarting a node with a
relay link skipped 'bridge create' and failed on add_nio_udp.

e2e (isolated instance): 13/13 — pref-1 tc_impair classifier on both
veths, 57% round-trip for N=3, -1 = exact 100%, quota hard cutoff,
delay coexistence, clean teardown, suspend/resume, node restart,
relay-leg frequency_drop regression through an Ethernet switch. Full
suite: 1925 passed.

gns3server/schemas/compute/nios.py

@@ -38,7 +38,7 @@ class UDPNIO(BaseModel):
     filters: Optional[dict] = Field(
         None,
         description="Packet filters (relay-supported types only: delay/packet_loss/corrupt/frequency_drop/bpf — "
-        "the netem extensions need a kernel-datapath NIO)",
+        "the netem extensions and the quota mode need a kernel-datapath NIO)",
     )
     markers: Optional[dict] = Field(None, description="Traffic-insight markers")
 
@@ -81,9 +81,9 @@ class BridgeNIO(BaseModel):
     delay/packet_loss/corrupt and the netem extensions (rate, reorder,
     gemodel, duplicate, seed, limit, jitter distributions, loss correlation)
     as one tc netem qdisc, bpf as cls_bpf match-drop classifiers (needs a
-    uBridge reporting cbpf). frequency_drop still has no kernel equivalent
-    and is rejected. Markers and packet capture are served by uBridge's
-    AF_PACKET modules on the veth host end.
+    uBridge reporting cbpf), frequency_drop and quota as the eBPF stateful
+    classifier (needs ebpf). Markers and packet capture are served by
+    uBridge's AF_PACKET modules on the veth host end.
     """
 
     type: BridgeNIOType
@@ -91,8 +91,8 @@ class BridgeNIO(BaseModel):
     suspend: Optional[bool] = Field(None, description="Suspend the NIO")
     filters: Optional[dict] = Field(
         None,
-        description="Packet filters served on the veth host end (delay/packet_loss/corrupt and the netem extensions "
-        "via one tc netem qdisc, bpf via cls_bpf)",
+        description="Packet filters served on the veth host end (netem surface + extensions via one tc netem qdisc, "
+        "bpf via cls_bpf, frequency_drop/quota via the eBPF classifier)",
     )
     markers: Optional[dict] = Field(None, description="Traffic-insight markers (attached to the veth host end)")