VAP15-53 docs: document webhook credential withholding - #1221

VAPSEC-564/619/623 changed a documented contract: when a server URL
arrives in the API request itself - a transient assistant, or
assistantOverrides - Vapi no longer attaches the org's webhook
credential, and credential fields in the payload arrive as [REDACTED].
The page still promised the old behavior, so a customer hitting this
sees an unauthenticated webhook and no explanation, indistinguishable
from a broken listener.

Adds three things to fern/server-url/server-authentication.mdx:

- A Quick start warning, so the "Vapi will now authenticate requests"
  promise carries its condition where a reader meets it rather than 300
  lines later.
- A "When credentials are not attached" section: which paths are
  caller-authored, the contrast that saved assistants, phone numbers and
  tools keep their credentials, and the [REDACTED] payload note.
- "Confirming a withheld send in your logs", carrying what support
  needs: the literal log string, the suppressed high-volume message
  types, and the trap that a missing entry does not mean credentials
  were sent.

The rollout qualifier is not optional polish. Without it the page states
the withholding unconditionally while pre-cutoff orgs are still gated by
ENABLE_WEBHOOK_CREDENTIAL_BINDING, so an unenrolled org could read "no
X-Vapi-Secret header" and conclude its secret is not reaching a
third-party URL when it still is - an inaccuracy in the unsafe
direction. It deliberately does not invite enrollment requests; the ramp
is a hand-maintained list with limited slots, mostly allocated.

ENFORCEMENT_DATE_TBD is a literal placeholder and a merge blocker. The
VAPSEC-689 cutoff is still being settled with the CISO, infosec and the
EM. A non-rendering MDX comment marks the spot.

Scoped to the webhook server URL. The message-options override paths
(tools, KB, custom voice, handoff and transfer destinations,
endpointing) are VAPSEC-627 and are documented separately in VAP15-54.

fern check: 0 errors, 12 pre-existing discriminator warnings.

Refs VAP15-53, VAPSEC-564, VAPSEC-619, VAPSEC-623, VAPSEC-689

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Replaces the ENFORCEMENT_DATE_TBD placeholder and drops the TODO that
guarded it. Unblocks merge.

VAPSEC-689 deploys on Monday 2026-09-21. The date is stated in UTC
because 2026-09-23T00:00:00Z is Tuesday 5pm Pacific: a cutoff written
as "2026-09-22" would have landed Monday 5pm Pacific, the same day as
the deploy and possibly before it, which trips the cutoff-ahead-of-
BUILD_DATE invariant that PR #19995 machine-checks. Wednesday UTC
leaves roughly thirty hours of margin and survives a Monday slip.

The (UTC) marker is there because the boundary is an instant, not a
calendar day. An org created Tuesday 5pm Pacific is created on
2026-09-23 UTC and is enforced, while its owner believes they signed
up on the 22nd.

This date must stay in sync with WEBHOOK_CREDENTIAL_BINDING_CUTOFF.
Fern cannot interpolate it, so a cutoff change needs a companion docs
PR. Recorded on VAPSEC-689.

Refs VAP15-53, VAPSEC-689

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Voice and terminology pass. Vapi becomes the actor throughout, spaced
hyphens become periods or colons, the log fence is tagged text, and the
suppressed-entry warning leads with what the reader actually has in
front of them. "Server Configuration" now matches the dashboard label
used in Quick start, and server.headers is called a field rather than a
parameter.

Two of the suggestions are applied with changes.

The redaction sentence keeps its explicit scope. Steve's version opened
"Vapi also strips credential fields", which drops the condition; the
condition is the whole point, since payloads on org-configured URLs are
not stripped, and a reader arriving by deep link has no surrounding
context to infer it from. Takes the active voice without the cut.

The rollout callout stays a Warning rather than becoming a Note. The
concern behind the suggestion is real - four stacked Warnings train
readers to skip them - but for an org that the phased rollout has not
reached, this paragraph is the harm notice: the org credential is still
going out to caller-supplied URLs today. Its terminology cleanup is
applied, so one term covers what was four.

Refs VAP15-53

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Takes the last of Steve's suggestions. Four stacked Warnings in forty
lines train readers to skip them, and this paragraph is the weakest
candidate to keep as a Warning: its text is unchanged either way, and
the whole callout is deleted under VAPSEC-654 once the flag is gone and
the rollout no longer exists to qualify.

Refs VAP15-53, VAPSEC-654

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>