feat(compute): report uBridge tc capabilities and gate filters on them

Consume uBridge's ebpf_modes contract (feature/tc-window 40c36ae): a
stateful mode is usable iff ebpf=1 and its token is listed; builds
predating the field keep their shipped modes (nth/quota/flow), so the
pre-correction window semantics can never be installed silently.

- gns3server/utils/tc_capabilities.py: shared reply parser, mode
  policy and filter-type mappings (compute and controller gate on the
  same rules)
- gns3server/compute/ubridge/tc_probe.py: standalone probe spawning a
  throwaway uBridge as the server's own user, cached by binary
  identity (path/mtime/size - the version string cannot distinguish
  rebuilds); failures cache as unknown
- GET /v3/compute/capabilities gains ubridge_tc {netem, ebpf,
  ebpf_modes, cbpf}; the controller forwards it (Compute.capabilities)
  and available_filters hides kernel-datapath filter types an endpoint
  compute cannot run (both ends apply their own filters, so one
  incapable compute hides the type); computes without a report keep
  the full list and apply-time 409 stays the guard
- docker: _ubridge_apply_ebpf_drops gates per mode token; the cleanup
  path only sends "off" for modes the build declares
- split DockerVM's kernel-datapath machinery (veth lifecycle, carrier,
  marker primitives, tc filter translation, kernel NIO teardown) into
  compute/docker/docker_kernel_datapath.py (DockerKernelDatapathMixin)

tests/controller/test_compute.py

@@ -381,7 +381,7 @@ async def test_json(compute):
         "disk_usage_percent": 0,
         "connected": True,
         "last_error": None,
-        "capabilities": {"version": "", "platform": "", "cpus": 0, "memory": 0, "disk_size": 0, "node_types": []},
+        "capabilities": {"version": "", "platform": "", "cpus": 0, "memory": 0, "disk_size": 0, "node_types": [], "ubridge_tc": None},
     }
     assert compute.asdict(topology_dump=True) == {
         "compute_id": "my_compute_id",

tests/controller/test_kernel_datapath_link.py

@@ -548,3 +548,45 @@ async def test_prepare_relay_link_strips_kernel_only_filters(project):
     # carries no filters — the relay filters one bridge)
     assert by_node[node1.id]["filters"] == {"frequency_drop": [7], "delay": [100, 20], "packet_loss": [5]}
     assert by_node[node2.id]["filters"] == {}
+
+
+@pytest.mark.asyncio
+async def test_available_filters_gated_by_compute_capabilities(project):
+    """
+    Kernel links only offer the filter types the endpoints' computes report
+    a uBridge able to run (ebpf_modes tokens, cbpf, netem keywords).
+    """
+
+    link, node1, _node2 = await _kernel_link(project)
+    link._link_data = [{"type": "nio_bridge"}]
+    node1.compute.capabilities = {
+        "ubridge_tc": {
+            "netem": ["delay", "jitter", "loss", "rate"],
+            "ebpf": True,
+            "ebpf_modes": ["nth", "quota"],
+            "cbpf": False,
+        }
+    }
+    types = [f["type"] for f in link.available_filters()]
+    assert "frequency_drop" in types  # nth declared
+    assert "quota" in types  # quota declared
+    assert "window_drop" not in types  # token missing
+    assert "bpf" not in types  # cbpf off
+    assert "rate" in types  # netem keyword present
+    assert "gemodel" not in types  # netem keyword missing
+    assert "delay" in types  # core netem runs on any tc-module build
+
+
+@pytest.mark.asyncio
+async def test_available_filters_unconstrained_without_report(project):
+    """
+    Computes that report no uBridge tc capabilities (older servers, failed
+    probe) impose no constraint: the full list stays offered and apply-time
+    validation is the guard.
+    """
+
+    from gns3server.controller.link import FILTERS
+
+    link, _node1, _node2 = await _kernel_link(project)
+    link._link_data = [{"type": "nio_bridge"}]
+    assert [f["type"] for f in link.available_filters()] == [f["type"] for f in FILTERS]