docs(port-conflict): refresh stale comments after the refactor

A few of the doc blocks in this file had drifted from what the code
actually does:

- inboundTransports' rule list claimed tunnel reads settings.network
  the same as shadowsocks. It doesn't — tunnel uses
  settings.allowedNetwork (3x-ui's wrapper around dokodemo-door).
- The "merge" hint above the settings-parsing block undersold what
  happens: SS / Tunnel override the streamSettings-derived bit while
  Mixed adds to it.
- portConflictDetail's example message and the checkPortConflict
  intro still mentioned "the old port-only check", a historical
  comparison that no longer says anything useful now that the
  transport-aware check is the only one.
- transportTagSuffix was documented as a generateInboundTag helper,
  but it's now also called by the conflict-error formatter.

Tighten the wording so future readers don't have to cross-check the
code against the doc.

web/service/port_conflict.go

@@ -159,17 +159,18 @@ func (d *portConflictDetail) String() string {
 // or updating an inbound on (listen, port) would clash with. nil result
 // means no conflict.
 //
-// unlike the old port-only check, this one understands that tcp/443 and
+// the check understands that tcp/443 and udp/443 are independent
-// udp/443 are independent sockets in linux and may coexist on the same
+// sockets in linux and may coexist on the same address (see
-// address.
+// inboundTransports for the per-protocol L4 mapping).
 //
 // node scope: inbounds with different NodeID run on different physical
 // machines (local panel xray vs a remote node, or two remote nodes),
 // so their sockets can't collide. only candidates with the same NodeID
 // participate in the listen/transport overlap check.
 //
-// the listen-overlap rule (specific addr conflicts with any-addr on the
+// listen overlap: a specific listen address conflicts with any-address
-// same port, both directions) is preserved from the previous check.
+// on the same port (both directions), otherwise only identical specific
+// addresses overlap.
 func (s *InboundService) checkPortConflict(inbound *model.Inbound, ignoreId int) (*portConflictDetail, error) {
 	db := database.GetDB()
 
@@ -232,10 +233,10 @@ func baseInboundTag(listen string, port int) string {
 	return fmt.Sprintf("inbound-%v:%v", listen, port)
 }
 
-// transportTagSuffix turns a transport mask into a short, stable string
+// transportTagSuffix turns a transport mask into a short, stable string.
-// for tag disambiguation. only used when the base "inbound-<port>" is
+// used both for generateInboundTag's disambiguation ("inbound-443-udp"
-// already taken on a coexisting transport (e.g. tcp inbound already lives
+// when the base "inbound-443" is taken on a coexisting transport) and
-// on 443 and we're now adding a udp one).
+// for the L4 hint in portConflictDetail's user-facing error message.
 func transportTagSuffix(b transportBits) string {
 	switch b {
 	case transportTCP: