feat(docker): traffic-insight markers on kernel-datapath links via AF_PACKET

Markers no longer disqualify the kernel datapath. They ride the NIO like
on the relay path and attach to the veth host end through uBridge's
marker add_kernel/delete_kernel/enable_kernel commands (AF_PACKET taps,
same BPF/direction/signal semantics as the relay mark filter).

- base_node: marker anchors are now polymorphic (relay bridge name or
  kernel veth host interface); the reconcile loop is datapath-agnostic
  and DockerVM overrides the add/delete/enable primitives to translate
  the commands. Marker-name validation extracted for both add paths.
- docker_vm: kernel NIO connect/update apply markers on the veth anchor;
  link deletion tears markers down explicitly (the veth survives the
  link, unlike a relay bridge whose death drops its filters).
- controller: eligibility and start_marker no longer exclude markers or
  project-level marker definitions; the kernel NIO carries the capture
  node's marker specs.
- NIO creation accepts markers on kernel NIOs (filters still rejected).

gns3server/schemas/compute/nios.py

@@ -74,17 +74,16 @@ class BridgeNIO(BaseModel):
     """
     Kernel-datapath bridge Network Input/Output properties. The NIO tells the
     node to enslave its veth host end into the named kernel bridge instead of
-    wiring a uBridge UDP relay. ``filters`` and ``markers`` must stay empty on
-    this datapath (rejected server-side); packet capture is supported via
-    uBridge's AF_PACKET module. Both are accepted as fields only because
-    link update payloads always carry the full NIO dictionary.
+    wiring a uBridge UDP relay. ``filters`` must stay empty on this datapath
+    (rejected server-side); markers and packet capture are served by uBridge's
+    AF_PACKET modules on the veth host end.
     """
 
     type: BridgeNIOType
     bridge: str = Field(..., description="Kernel bridge name e.g. gns3a1b2c3d4e5")
     suspend: Optional[bool] = Field(None, description="Suspend the NIO")
     filters: Optional[dict] = Field(None, description="Packet filters (unsupported, must be empty)")
-    markers: Optional[dict] = Field(None, description="Traffic-insight markers (unsupported, must be empty)")
+    markers: Optional[dict] = Field(None, description="Traffic-insight markers (attached to the veth host end)")
 
 
 class MarkerToggle(BaseModel):