feat(compute): report uBridge tc capabilities and gate filters on them

Consume uBridge's ebpf_modes contract (feature/tc-window 40c36ae): a
stateful mode is usable iff ebpf=1 and its token is listed; builds
predating the field keep their shipped modes (nth/quota/flow), so the
pre-correction window semantics can never be installed silently.

- gns3server/utils/tc_capabilities.py: shared reply parser, mode
  policy and filter-type mappings (compute and controller gate on the
  same rules)
- gns3server/compute/ubridge/tc_probe.py: standalone probe spawning a
  throwaway uBridge as the server's own user, cached by binary
  identity (path/mtime/size - the version string cannot distinguish
  rebuilds); failures cache as unknown
- GET /v3/compute/capabilities gains ubridge_tc {netem, ebpf,
  ebpf_modes, cbpf}; the controller forwards it (Compute.capabilities)
  and available_filters hides kernel-datapath filter types an endpoint
  compute cannot run (both ends apply their own filters, so one
  incapable compute hides the type); computes without a report keep
  the full list and apply-time 409 stays the guard
- docker: _ubridge_apply_ebpf_drops gates per mode token; the cleanup
  path only sends "off" for modes the build declares
- split DockerVM's kernel-datapath machinery (veth lifecycle, carrier,
  marker primitives, tc filter translation, kernel NIO teardown) into
  compute/docker/docker_kernel_datapath.py (DockerKernelDatapathMixin)

docs/design/ubridge-kernel-impairment-spec.md

@@ -293,13 +293,23 @@ old uBridge without these commands simply stays on the relay datapath):
 
 ```
 tc capabilities
-100-netem=delay,jitter,loss,dup,corrupt,rate,reorder,gemodel,dist,seed,limit;ebpf=1;cbpf=1
+100-netem=delay,jitter,loss,dup,corrupt,rate,reorder,gemodel,dist,seed,limit;ebpf=1;cbpf=1;ebpf_modes=nth,quota,window,flow
 ```
 
 `ebpf=0` when the load probe fails at startup (kernel < 5.1 or no CAP_BPF);
 `cbpf=0` when RTM_NEWTFILTER/cls_bpf is unavailable. gns3-server hides the
 corresponding filter types per capability.
 
+`ebpf_modes` (added on uBridge `feature/tc-window`, commit 40c36ae) is a
+build fact, orthogonal to the runtime probes: the same binary flips `ebpf`
+between users and kernels while the mode set changes only with the binary.
+A mode is usable iff `ebpf=1` **and** its token is listed — gating
+`window_drop` on `ebpf=1` alone silently accepts the 4-arg form on a
+pre-correction build (`feature/tc-precision`: back-to-back windows, no
+gap). Builds that do not emit the field at all predate it and get legacy
+treatment; an incompatible mode revision renames its token
+(`window` → `window2`) rather than versioning in place.
+
 ---
 
 ## F. Test requirements
@@ -338,6 +348,14 @@ corresponding filter types per capability.
   mirrors the grammar's `period ≥ outage` rule and treats `start = 0` as
   active (an immediate outage).
   Not yet exposed: `flow_drop` (parameter-shape UX decision).
+* **Done** (capability reporting): the `ebpf_modes` contract is consumed
+  end to end — the compute applies it per mode (window requires its token;
+  pre-field builds keep their shipped modes), the compute
+  `GET /capabilities` payload reports `ubridge_tc` through a standalone
+  spawn-as-own-user probe cached by binary identity, and the controller's
+  `available_filters` hides kernel-datapath filter types an endpoint
+  compute reports it cannot run (computes without a report keep the full
+  list; apply-time 409 stays the guard).
 * Every veth end owns one qdisc + its filters: per-direction impairment is
   an architectural freebie to expose later (API `direction` field), aligned
   with marker `dir` semantics.

docs/features/docker-kernel-datapath.md

@@ -293,6 +293,27 @@ Semantics:
   frames (on the relay, filter-vs-mark ordering determined visibility
   instead). Also note `tc qdisc show` cannot print a distribution's name
   (the kernel stores only the sampled table).
+* **eBPF mode tokens.** A stateful mode is usable iff `tc capabilities`
+  reports `ebpf=1` **and** lists the mode's token in `ebpf_modes`
+  (uBridge `feature/tc-window`+). Builds predating the field keep the modes
+  that shipped with it — everything but `window`, whose semantics were
+  corrected exactly when the field was added: gating on `ebpf=1` alone
+  would silently install the broken back-to-back-window behaviour on a
+  pre-correction build. Requesting an unusable mode fails the apply with an
+  upgrade error; the cleanup ("off") path only touches modes the build
+  declares.
+* **Capability reporting.** The compute exposes the probe through
+  `GET /v3/compute/capabilities` as `ubridge_tc` (netem keyword list,
+  `ebpf`/`cbpf` flags, and the usable `ebpf_modes` — legacy fallback
+  applied), answered by a throwaway uBridge spawned as the server's own
+  user and cached by binary identity — the runtime `ebpf` flag flips
+  between users and kernels for the same binary, so a root-run probe would
+  lie for a non-root server. The controller forwards it through
+  `GET /v3/computes` and `available_filters` hides kernel-datapath filter
+  types an endpoint compute reports it cannot run (both ends apply their
+  own filters, so one incapable compute is enough). Computes that report
+  nothing — older servers, failed probe — keep the full list;
+  apply-time validation (409) stays the guard.
 
 ## uBridge command surface
 
@@ -313,7 +334,7 @@ tc nth_drop <if> <n | off>        # eBPF exact every-Nth (frequency_drop)
 tc quota_drop <if> <bytes> <pct> | off   # eBPF byte cap (quota)
 tc window_drop <if> <start_ms> <outage_ms> <pct> [<period_ms> [<jitter_ms>]] | off  # eBPF time window (window_drop)
 tc reset <if>                     # full restore: eBPF filter -> bpf_drops -> clsact -> root qdisc, idempotent
-tc capabilities                   # "netem=<kw,...>;ebpf=0|1;cbpf=0|1", probed once per process
+tc capabilities                   # "netem=<kw,...>;ebpf=0|1;cbpf=0|1[;ebpf_modes=<modes>]", probed once per process
 bridge add_nio_ethernet / add_nio_udp / start / stop / start_capture / stop_capture
 ```