feat(compute): report uBridge tc capabilities and gate filters on them

Consume uBridge's ebpf_modes contract (feature/tc-window 40c36ae): a
stateful mode is usable iff ebpf=1 and its token is listed; builds
predating the field keep their shipped modes (nth/quota/flow), so the
pre-correction window semantics can never be installed silently.

- gns3server/utils/tc_capabilities.py: shared reply parser, mode
  policy and filter-type mappings (compute and controller gate on the
  same rules)
- gns3server/compute/ubridge/tc_probe.py: standalone probe spawning a
  throwaway uBridge as the server's own user, cached by binary
  identity (path/mtime/size - the version string cannot distinguish
  rebuilds); failures cache as unknown
- GET /v3/compute/capabilities gains ubridge_tc {netem, ebpf,
  ebpf_modes, cbpf}; the controller forwards it (Compute.capabilities)
  and available_filters hides kernel-datapath filter types an endpoint
  compute cannot run (both ends apply their own filters, so one
  incapable compute hides the type); computes without a report keep
  the full list and apply-time 409 stays the guard
- docker: _ubridge_apply_ebpf_drops gates per mode token; the cleanup
  path only sends "off" for modes the build declares
- split DockerVM's kernel-datapath machinery (veth lifecycle, carrier,
  marker primitives, tc filter translation, kernel NIO teardown) into
  compute/docker/docker_kernel_datapath.py (DockerKernelDatapathMixin)

gns3server/api/routes/compute/capabilities.py

@@ -25,19 +25,33 @@ from fastapi import APIRouter, Request
 
 from gns3server import schemas
 from gns3server.compute import MODULES
+from gns3server.compute.ubridge.tc_probe import probe_tc_capabilities
 from gns3server.utils.path import get_default_project_directory
+from gns3server.utils.tc_capabilities import usable_ebpf_modes
 from gns3server.version import __version__
 
 router = APIRouter()
 
 
 @router.get("/capabilities", response_model=schemas.Capabilities)
-def get_capabilities(request: Request) -> dict:
+async def get_capabilities(request: Request) -> dict:
 
     node_types = []
     for module in MODULES:
         node_types.extend(module.node_types())
 
+    # Kernel-datapath packet filters: what this host's uBridge can run,
+    # probed as the server's own user (None = unknown, old/missing uBridge).
+    ubridge_tc = None
+    caps = await probe_tc_capabilities()
+    if caps:
+        ubridge_tc = {
+            "netem": [keyword for keyword in caps.get("netem", "").split(",") if keyword],
+            "ebpf": caps.get("ebpf") == "1",
+            "ebpf_modes": list(usable_ebpf_modes(caps)),
+            "cbpf": caps.get("cbpf") == "1",
+        }
+
     # record the controller hostname or IP address
     if request.client:
         request.app.state.controller_host = request.client.host
@@ -49,4 +63,5 @@ def get_capabilities(request: Request) -> dict:
         "memory": psutil.virtual_memory().total,
         "disk_size": psutil.disk_usage(get_default_project_directory()).total,
         "node_types": node_types,
+        "ubridge_tc": ubridge_tc,
     }