fix(api, web, docs): refine port ACL logic and documentation updates

- Updated the `evofw-firewall.sh` script to clarify the handling of incoming traffic for port ACLs, ensuring accurate rule application for Docker NAT and local addresses.
- Enhanced the UI description for port ACLs to specify that only incoming traffic is affected, improving user understanding of the firewall behavior.
- Revised documentation to reflect the updated logic for port ACLs, emphasizing the distinction between incoming and outgoing traffic and the implications for service accessibility.

These changes improve the clarity and functionality of port ACL management, enhancing user experience and system reliability.

apps/web/src/components/agents/agent-port-acl.tsx

@@ -689,9 +689,9 @@ export function AgentPortAcl({ agentId }: AgentPortAclProps) {
             <div className="flex flex-col gap-px">
               <FrameTitle>Port ACL</FrameTitle>
               <FrameDescription>
-                Open по списку — порт только с этих IP (хост и Docker).
-                Системные порты можно переопределить. Apply через nft
-                (upgrade install-ссылкой).
+                Open по списку — входящие на порт только с этих IP (хост и
+                Docker publish). Исходящий клиентский 80/443 не режется.
+                Apply через nft (upgrade install-ссылкой).
               </FrameDescription>
             </div>
             <div className="flex shrink-0 flex-wrap gap-2">