Fix entries-without-claims visibility for auth-only mode

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: rdimitrov

docs/toolhive/guides-registry/authorization.mdx

@@ -221,12 +221,13 @@ caller's claims must be a superset of the resource's claims. For example:
 | `{org: "acme"}`                   | `{org: "contoso"}`                | Denied  |
 
 Registries and sources with no claims are accessible to all authenticated
-callers. However, **entries** with no claims behave differently: they are only
-visible in anonymous mode. When authorization is enabled, an authenticated
-caller's per-entry filter requires both sides to have claims for a match — so
-entries without claims are invisible. To make entries visible to authenticated
-callers, attach claims to the source (for synced sources) or to individual
-entries (via the publish payload or the
+callers. However, **entries** with no claims behave differently: they are
+visible in anonymous mode and [auth-only mode](#auth-only-mode), but invisible
+when full authorization is enabled. With authorization, the per-entry filter
+requires both sides to have claims for a match — so entries without claims are
+filtered out. To make entries visible to authorized callers, attach claims to
+the source (for synced sources) or to individual entries (via the publish
+payload or the
 [`authz-claims` annotation](./configuration.mdx#per-entry-claims-via-annotation)
 for Kubernetes sources).
 

docs/toolhive/guides-registry/configuration.mdx

@@ -417,8 +417,9 @@ spec:
 
 Entry claims come exclusively from the annotation — source-level claims are
 **not** inherited. Entries without the annotation have no claims, which means
-they are visible in anonymous mode but invisible when authorization is
-configured.
+they are visible in anonymous mode and
+[auth-only mode](./authorization.mdx#auth-only-mode) but invisible when full
+authorization is configured.
 
 If the annotation contains invalid JSON or unsupported claim value types
 (anything other than strings or arrays of strings), the entry is **skipped