feat(docker): packet capture on kernel-datapath links via AF_PACKET

Replace the capture rejection with wiring to uBridge's capture module:
an AF_PACKET socket bound to the veth host end writes into the same pcap
file the relay path uses (capture start_kernel <if> "<pcap>" /
capture stop_kernel), so the pcap streaming to clients is unchanged.

- capture survives node restarts: _connect_nio re-arms it when the NIO
  is already capturing, mirroring the relay path
- uBridge's kernel capture is a singleton per process: a concurrent
  second capture on the same node surfaces uBridge's EALREADY error
- update the datapath docs: filters and markers remain relay-only,
  capture is now served on both datapaths

gns3server/controller/link.py

@@ -116,7 +116,8 @@ class Link:
         """
         Whether this link is wired on the kernel datapath (veth pairs
         enslaved into a per-link Linux bridge — no uBridge relay in the
-        forwarding path, so filters, markers and capture are unavailable).
+        forwarding path, so filters and markers are unavailable; capture is
+        served by uBridge's AF_PACKET module).
         """
         return any(d.get("type") == "nio_bridge" for d in (getattr(self, "_link_data", None) or []))
 

gns3server/controller/udp_link.py

@@ -135,8 +135,9 @@ class UDPLink(Link):
         """
         Whether this link can be wired on the kernel datapath (veth pairs
         enslaved into a per-link Linux bridge) instead of the uBridge UDP
-        relay. The kernel path has no userspace relay, so filters, markers
-        and packet capture — which all live in the relay — disqualify it.
+        relay. The kernel path has no userspace relay, so filters and
+        markers — which live in the relay — disqualify it (capture is
+        served separately by uBridge's AF_PACKET module).
         It is host-local (same compute) and requires the adapter interfaces
         to be created as veths at container start, hence stopped nodes only.
         """