Reject non-443 MITM port updates in the settings API and normalize
stored configuration back to the required transparent interception
port.
Lock the dashboard port field to 443, update the validation copy, and
add integration coverage to prevent stale custom ports from being
accepted or surfaced.