Docs-review fixes on v0.23.1 release docs

- migrate-to-v1beta1.mdx: replace the kubectl --raw API
  discovery command with a jq query over CRD
  status.storedVersions, which actually identifies CRDs
  still holding v1alpha1-stored resources (the previous
  command only listed kinds served at v1alpha1, always
  all of them).
- auth-k8s.mdx: smooth out the awkward leading-ellipsis
  sentence in the "Default callback URL for upstream
  providers" section by merging it into the preceding
  sentence and dropping the parenthetical em-dash-like
  aside in favor of a natural "for example" clause.

Co-authored-by: Radoslav Dimitrov <undefined@users.noreply.github.com>

Author: github-actions[bot]

docs/toolhive/guides-k8s/auth-k8s.mdx

@@ -811,7 +811,8 @@ spec:
     resourceUrl: 'https://mcp.example.com/mcp'
 ```
 
-Omitting `redirectUri` on the upstream provider:
+Omitting `redirectUri` on the upstream provider resolves the callback to
+`https://mcp.example.com/mcp/oauth/callback`:
 
 ```yaml
 upstreamProviders:
@@ -827,11 +828,10 @@ upstreamProviders:
       # https://mcp.example.com/mcp/oauth/callback
 ```
 
-...resolves to `https://mcp.example.com/mcp/oauth/callback`. Set
-`redirectUri` explicitly if you need a non-default callback path (for example,
-to route the callback through a separate gateway hostname). If `resourceUrl`
-is also unset, no default is applied and the upstream provider must have
-`redirectUri` set explicitly.
+Set `redirectUri` explicitly if you need a non-default callback path, for
+example to route the callback through a separate gateway hostname. If
+`resourceUrl` is also unset, no default is applied and the upstream provider
+must have `redirectUri` set explicitly.
 
 ## Set up authorization
 

docs/toolhive/guides-k8s/migrate-to-v1beta1.mdx

@@ -767,12 +767,14 @@ To find remaining `v1alpha1` manifests in a Git repository:
 grep -rn 'toolhive.stacklok.dev/v1alpha1' .
 ```
 
-To find `v1alpha1` resources already in the cluster and identify which kinds
-still need re-applying:
+To check which CRDs still list `v1alpha1` in `status.storedVersions` (these
+have at least one stored resource that has not yet been re-applied at
+`v1beta1`):
 
 ```bash
-kubectl get -A --raw \
-  "/apis/toolhive.stacklok.dev/v1alpha1" | jq '.resources[].name'
+kubectl get crds -o json | jq -r '.items[]
+  | select(.spec.group == "toolhive.stacklok.dev")
+  | "\(.metadata.name): \(.status.storedVersions)"'
 ```
 
 ## Next steps