* fix(inbounds): check ports when an inbound is enabled, not only when it is saved
The save-time guards compare enabled rows, so a row could be created while
another disabled row held its port and only collide once the disabled one was
switched on. Run the same checks before the flag moves: the refusal names the
row that owns the port, the flag is left alone, and tcp/udp coexistence and
node rows keep working.
* docs(inbounds): state the real reason the enable path needs its own check
BlindMaster24