Address feedback

- note about `jwksAllowPrivateIP: true`

Author: tgrunnagle

docs/toolhive/guides-vmcp/authentication.mdx

@@ -427,10 +427,9 @@ at `authed_user.access_token`). Add a `tokenResponseMapping` block to the
 ### Incoming auth with the embedded auth server
 
 When using the embedded auth server, configure `incomingAuth` to validate the
-JWTs it issues. The `issuer` must match `authServerConfig.issuer`. If the issuer
-URL resolves to a private or cluster-internal IP address (typical in
-Kubernetes), set `jwksAllowPrivateIP` to `true` so the OIDC middleware can fetch
-the JWKS from the embedded auth server's discovery endpoint:
+JWTs it issues. The `issuer` must match `authServerConfig.issuer`. Note that as
+of version 0.15.0, `jwksAllowPrivateIP: true` is no longer needed because JWKS
+retrieval is done in-process when the embedded auth server is present.
 
 ```yaml title="VirtualMCPServer resource"
 spec:
@@ -442,7 +441,6 @@ spec:
       inline:
         issuer: https://auth.example.com
         audience: https://mcp.example.com/mcp
-        jwksAllowPrivateIP: true
 ```
 
 The `resourceUrl` is the externally reachable URL of the MCP endpoint. MCP
@@ -575,7 +573,6 @@ spec:
       inline:
         issuer: https://auth.example.com
         audience: https://mcp.example.com/mcp
-        jwksAllowPrivateIP: true
   outgoingAuth:
     source: inline
     backends: