Restructure vMCP authentication docs around scenarios

docs/toolhive/concepts/embedded-auth-server.mdx

@@ -269,15 +269,15 @@ resources, with some differences:
 For single-backend deployments on MCPServer, the embedded auth server
 automatically swaps the token for each request. For vMCP with multiple backends,
 you configure which upstream provider's token goes to which backend using
-[upstream token injection](../guides-vmcp/authentication.mdx#upstream-token-injection)
+[upstream token injection](../guides-vmcp/embedded-auth-server-vmcp.mdx#forward-a-stored-upstream-token-upstream-injection)
 or
-[token exchange with upstream tokens](../guides-vmcp/authentication.mdx#token-exchange-with-upstream-tokens).
+[token exchange with upstream tokens](../guides-vmcp/embedded-auth-server-vmcp.mdx#exchange-a-stored-upstream-token-token-exchange).
 
 ## Next steps
 
 - [Set up the embedded authorization server in Kubernetes](../guides-k8s/embedded-auth-server-k8s.mdx)
   for step-by-step setup of MCPServer resources in Kubernetes
-- [Configure the vMCP embedded authorization server](../guides-vmcp/authentication.mdx#embedded-authorization-server)
+- [Configure the vMCP embedded authorization server](../guides-vmcp/embedded-auth-server-vmcp.mdx)
   for multiple upstream providers on a VirtualMCPServer
 - [Deploy Redis Sentinel](../guides-k8s/redis-session-storage.mdx) for
   production session storage

docs/toolhive/concepts/vmcp.mdx

@@ -143,7 +143,7 @@ auth server acquires tokens from each upstream provider and injects them into
 requests to the appropriate backends. MCP clients register or identify
 themselves automatically through Client ID Metadata Documents (CIMD) or Dynamic
 Client Registration (DCR), so no manual client configuration is needed. See
-[Authentication](../guides-vmcp/authentication.mdx#embedded-authorization-server)
+[Embedded authorization server](../guides-vmcp/embedded-auth-server-vmcp.mdx)
 for setup details.
 
 ## When to use vMCP

docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx

@@ -746,7 +746,7 @@ attempt.
 - For the other Kubernetes authentication approaches, see
   [Authentication and authorization](./auth-k8s.mdx)
 - For multi-upstream provider support with vMCP, see
-  [vMCP embedded authorization server](../guides-vmcp/authentication.mdx#embedded-authorization-server)
+  [vMCP embedded authorization server](../guides-vmcp/embedded-auth-server-vmcp.mdx)
 - For a similar configuration pattern using token exchange, see
   [Configure token exchange](./token-exchange-k8s.mdx)
 - For combining the embedded auth server with AWS STS, see

docs/toolhive/guides-k8s/remote-mcp-proxy.mdx

@@ -831,7 +831,7 @@ any other backend. (In inline mode, you list the backends in the
 VirtualMCPServer spec instead.) If the proxy is configured to validate incoming
 requests, whether through `oidcConfigRef` or an embedded authorization server,
 configure an
-[outgoing authentication strategy](../guides-vmcp/authentication.mdx#outgoing-authentication)
+[backend authentication strategy](../guides-vmcp/authentication.mdx#backend-authentication)
 on the vMCP so it presents a token the proxy accepts, such as `upstreamInject`
 to forward a user's upstream token or `tokenExchange` to obtain a token with the
 proxy's expected audience. A proxy left without an authentication source accepts