feat(docker): unify adapter interfaces on veth, allow kernel links at runtime

Every Docker adapter is now born as a veth pair at container start
(unified interface) regardless of NIO type: guest end in the container
namespace, host end in the root namespace. Kernel links enslave the host
end into the per-link Linux bridge; relay links attach it to the uBridge
relay via AF_PACKET (bridge add_nio_ethernet) — the TAP path is gone.

This makes the datapath a runtime decision:
- links can be created on running containers (kernel or relay) without
  touching container interfaces — the controller stopped-node
  eligibility check is removed
- project reopen re-prepares relay links and upgrades eligible ones to
  the kernel datapath
- packet capture start/stop now key on the NIO type (not veth presence)
  so relay-over-veth captures use the relay capture, kernel ones the
  AF_PACKET module
- vendor unix-socket containers keep their wiring: no veth is required
  on the relay path

gns3server/controller/udp_link.py

@@ -138,8 +138,12 @@ class UDPLink(Link):
         relay. The kernel path has no userspace relay, so filters — which
         live in the relay — disqualify it. Markers and capture are served
         by uBridge's AF_PACKET modules on the veth host end.
-        It is host-local (same compute) and requires the adapter interfaces
-        to be created as veths at container start, hence stopped nodes only.
+
+        Docker adapters are born as veth pairs (unified interface), so the
+        datapath is a runtime decision — links attach to running containers
+        too: the compute side enslaves the veth host end (brctl) or attaches
+        the relay to it (add_nio_ethernet) without touching the container's
+        interfaces.
         """
 
         if not Config.instance().settings.Server.enable_kernel_datapath:
@@ -150,10 +154,6 @@ class UDPLink(Link):
             return False
         if self.get_active_filters():
             return False
-        # Running nodes already have relay TAPs wired into uBridge; the
-        # kernel path needs the veth variant created at container start.
-        if node1.status != "stopped" or node2.status != "stopped":
-            return False
         if _is_unix_socket_docker(node1) or _is_unix_socket_docker(node2):
             return False
         return True