feat(qemu): anchor QEMU adapters on a persistent TAP

QEMU had no host-side interface at all: every adapter was a local UDP tunnel
into uBridge (-netdev socket plus two UDP ports per adapter), so a link could
only ever be a userspace relay. Each adapter now owns a persistent TAP
(gq{node_id[:8]}e{adapter}p{port}), created by uBridge before QEMU is launched
and handed to this user, and the netdev is that TAP -- the anchor role Docker's
veth host end plays. Links attach to it:

* kernel link (NIOBridge): brctl create/up/addif enslaves the TAP into the
  per-link bridge and capture, markers and tc filters are installed on it,
  verbatim through the shared KernelDatapathMixin -- a TAP and a veth host end
  are interchangeable there (an egress qdisc on either impairs traffic entering
  the node, and PACKET_OUTGOING on either is the node receiving);
* relay link: bridge add_nio_ethernet plus add_nio_udp -- AF_PACKET, never the
  TAP NIO, which would take the fd QEMU itself holds.

The netdev type is fixed at launch, so this is all-or-nothing per VM: on the
TAP datapath every link type attaches to (or detaches from) a running VM,
including switching a link between the two datapaths. Stop un-persists the
TAPs (QEMU's open fd keeps each device alive until it exits) and removes the
per-link bridges; start sweeps leftovers first. A uBridge without the tap
module keeps the previous socket-netdev datapath, so an unupgraded install is
unaffected -- such a node simply cannot carry kernel links.

gns3server/compute/docker/docker_vm.py

@@ -1896,16 +1896,9 @@ class DockerVM(DockerKernelDatapathMixin, BaseNode):
                 if self.status == "started":
                     host_ifc = self._kernel_veths.get((adapter_number, port_number))
                     if host_ifc is not None:
-                        # Incremental marker reconcile on the veth anchor —
-                        # the relay-datapath equivalent of the branch below.
-                        await self._ubridge_apply_markers(host_ifc, nio)
-                        # The netem apply resets the interface first (the
-                        # kernel merges optional netem attrs on replace), so
-                        # everything anchored on clsact must re-apply after
-                        # it: bpf drops flush + re-add, eBPF modes re-set.
-                        await self._ubridge_apply_netem(host_ifc, nio.filters)
-                        await self._ubridge_apply_bpf_drops(host_ifc, nio.filters)
-                        await self._ubridge_apply_ebpf_drops(host_ifc, nio.filters)
+                        # Incremental marker + filter reconcile on the anchor
+                        # — the relay-datapath equivalent of the branch below.
+                        await self._kernel_update(host_ifc, nio)
                     await self._set_adapter_carrier(adapter_number, not nio.suspend, port_number)
                 return