[Gap]: CIMD and DCR configuration missing from vMCP embedded auth server guide

[danbarr]

What needs documentation?

The vMCP embedded auth server guide (docs/toolhive/guides-vmcp/embedded-auth-server-vmcp.mdx) name-drops both CIMD (Client ID Metadata Document) and DCR (Dynamic Client Registration) in a single intro sentence but never documents how to configure either one. There's no cimd: or dcrConfig: field in any of the guide's YAML examples, no field-reference entries, and no troubleshooting guidance.

This is a real gap because both features are fully functional for VirtualMCPServer today — spec.authServerConfig uses the exact same EmbeddedAuthServerConfig type as MCPExternalAuthConfig, so CIMD and DCR work identically for vMCP as they do for MCPServer. The docs just haven't caught up.

Context and references

The Kubernetes/MCPServer-side guide (docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx) already has this content and can serve as the source to adapt from:

• CIMD: ### Enable CIMD for zero-registration clients section with YAML for cimd.enabled, cimd.cacheMaxSize, cimd.cacheFallbackTtl, validation rules, an SSRF note, a field-reference table row, and three troubleshooting entries.
• DCR: ### Use dynamic client registration with an upstream provider section with YAML for dcrConfig.discoveryUrl, dcrConfig.registrationEndpoint, dcrConfig.initialAccessTokenRef, plus an explicit statement that client-side DCR is always-on with no config needed.

Use case

As a user configuring a VirtualMCPServer's embedded auth server, I want to enable CIMD or upstream DCR the same way I can for a plain MCPServer, but the vMCP guide gives me no field names, no YAML example, and no troubleshooting steps to do so.

Additional context

Since the underlying config type is shared between the two CRDs, most of the k8s guide's CIMD/DCR prose and YAML can likely be adapted directly, just swapping the CRD path (spec.authServerConfig on VirtualMCPServer vs. spec.embeddedAuthServer via MCPExternalAuthConfig).