fix(inbound): remove stale mkcp-legacy finalmask when switching away from mKCP

Switching the transport to mKCP auto-seeds a mkcp-legacy entry into
finalmask.udp, but switching back to another transport only dropped the
kcpSettings blob and left the mask behind. It survived downstream pruning
(finalmask.udp was non-empty) and bled into every client share link.

Strip auto-seeded mkcp-legacy entries from finalmask.udp whenever the
network changes away from kcp, leaving user-authored masks intact.

Fixes #5221

frontend/src/pages/inbounds/form/InboundFormModal.tsx

@@ -691,13 +691,13 @@ export default function InboundFormModal({
       {isFallbackHost && fallbacksCard}
       {(protocol === Protocols.VLESS || protocol === Protocols.TROJAN)
         && network === 'tcp' && !isFallbackHost && (
-        <Alert
-          className="mt-12"
-          type="info"
-          showIcon
-          message={t('pages.inbounds.fallbacks.needsTls')}
-        />
-      )}
+          <Alert
+            className="mt-12"
+            type="info"
+            showIcon
+            message={t('pages.inbounds.fallbacks.needsTls')}
+          />
+        )}
     </>
   );
 
@@ -749,6 +749,12 @@ export default function InboundFormModal({
           udp: [...udp, { type: 'mkcp-legacy', settings: { header: '', value: '' } }],
         };
       }
+    } else {
+      const fm = cleaned.finalmask as Record<string, unknown> | undefined;
+      if (fm && Array.isArray(fm.udp)) {
+        const udp = (fm.udp as unknown[]).filter((m) => (m as { type?: string })?.type !== 'mkcp-legacy');
+        cleaned.finalmask = { ...fm, udp };
+      }
     }
     form.setFieldValue('streamSettings', cleaned);
   };