controller: allow markers and packet filters on Ethernet switch links

The brctl Ethernet switch runs a per-port uBridge relay, so it can host
the mark filter and packet filters like any uBridge-backed node. Add
ethernet_switch to _MARKER_CAPABLE_TYPES and _get_filter_node, narrow the
UDPLink.update() NIO-PUT skip down to the Dynamips-hosted ethernet_hub,
and expose the matching compute endpoints: PUT nio (filter/marker
reapply) plus the per-marker toggle/pause/resume/delete/rebuild routes.

The ethernet_hub keeps its exclusion: its routes still wire into the
Dynamips hub, which has no uBridge of its own.

docs/features/builtin-ethernet-switch-ubridge.md

@@ -85,7 +85,11 @@ bridge start {node_id}-{port}
 ```
 
 Captures and marker signals are applied via the existing `_ubridge_apply_filters`
-and `_ubridge_apply_markers` helpers from `BaseNode`.
+and `_ubridge_apply_markers` helpers from `BaseNode`. The controller therefore allows
+packet filters and traffic-insight markers on switch links (including switch-to-switch):
+`ethernet_switch` is a marker/filter-capable node type, and the compute API exposes the
+matching NIO-update and per-marker endpoints. The `ethernet_hub` — still Dynamips-hosted,
+no uBridge — remains excluded.
 
 ### `remove_nio(port_number)`
 

docs/features/marker-traffic-insight.md

@@ -97,8 +97,8 @@ IOU runs a single `IOL-BRIDGE` per node shared by every interface, so `bridge`+`
 identical across that node's links. uBridge keeps a separate filter list **per port
 (bay/unit)** within the bridge, so each interface gets its own `global-{name}` filter, its own
 pcap file, and its own `link=`. The shared bridge name is irrelevant to attribution. Other
-capable node types (`qemu`, `docker`, `vpcs`, `cloud`) already use one bridge per link; `link`
-applies uniformly to all of them.
+capable node types (`qemu`, `docker`, `vpcs`, `cloud`, `ethernet_switch`) already use one
+bridge per link (the switch's per-port relay); `link` applies uniformly to all of them.
 
 ## Direction
 
@@ -137,7 +137,7 @@ pass `capture_node_id` on marker **create**:
 ```
 
 The value must be one of the link's two endpoints and a marker-capable type (`vpcs`, `qemu`,
-`docker`, `iou`, `dynamips`, `cloud`); any other id is rejected with `409`. Omit it to keep
+`docker`, `iou`, `dynamips`, `cloud`, `ethernet_switch`); any other id is rejected with `409`. Omit it to keep
 the auto-pick. The chosen id is echoed back as `capture_node_id` in the marker entry and in
 each `MARK` signal's `node=<id>`, so the Web UI always knows the observer regardless of who
 picked it.
@@ -357,7 +357,9 @@ direction relative to the capture node; see [Direction](#direction).
   runs one `tcpdump -d` rather than *N*. (uBridge still runs `pcap_compile` itself at
   install time, so an invalid expression can never slip through.)
 - **Supported node types.** A marker needs a uBridge bridge: `vpcs`, `qemu`, `docker`,
-  `iou`, `dynamips`, `cloud` (one capable endpoint suffices). Types without a uBridge are
+  `iou`, `dynamips`, `cloud`, `ethernet_switch` (one capable endpoint suffices). The
+  `ethernet_switch` hosts markers on its per-port uBridge relays (brctl backend); the
+  `ethernet_hub` is still Dynamips-hosted and has no uBridge. Types without a uBridge are
   silently skipped by the inheritance fan-out. IOU uses one shared `IOL-BRIDGE` per node but
   keeps filters, pcap files, and `link=` ids per port, so multi-interface nodes are handled
   (see [Per-link attribution](#per-link-attribution)).