feat(docker): packet capture on kernel-datapath links via AF_PACKET

Replace the capture rejection with wiring to uBridge's capture module:
an AF_PACKET socket bound to the veth host end writes into the same pcap
file the relay path uses (capture start_kernel <if> "<pcap>" /
capture stop_kernel), so the pcap streaming to clients is unchanged.

- capture survives node restarts: _connect_nio re-arms it when the NIO
  is already capturing, mirroring the relay path
- uBridge's kernel capture is a singleton per process: a concurrent
  second capture on the same node surfaces uBridge's EALREADY error
- update the datapath docs: filters and markers remain relay-only,
  capture is now served on both datapaths

gns3server/controller/link.py

@@ -116,7 +116,8 @@ class Link:
         """
         Whether this link is wired on the kernel datapath (veth pairs
         enslaved into a per-link Linux bridge — no uBridge relay in the
-        forwarding path, so filters, markers and capture are unavailable).
+        forwarding path, so filters and markers are unavailable; capture is
+        served by uBridge's AF_PACKET module).
         """
         return any(d.get("type") == "nio_bridge" for d in (getattr(self, "_link_data", None) or []))