VAP15-53 docs(server-url): match changelog rollout wording, scope "always"

Two review threads from the copy doc.

"applying this change gradually" -> "as a phased rollout", matching the only
precedent in the docs (2026-05-18 changelog, "a phased release"). No house
style for feature flags exists; this is the nearest thing. Also drops "of
this rule" as redundant once "rollout" is named.

"Credential withholding always happens" -> "always happens on this path".
"Always" read as a general claim about every webhook; it is specific to
caller-supplied server urls, same scoping fix as the redaction sentence.

Refs VAP15-53

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: jeffrey-hoekman-vapi

fern/server-url/server-authentication.mdx

@@ -399,7 +399,7 @@ It does **not** apply to a saved assistant, phone number, or tool, or to your or
     with the placeholder in place. */}
 
 <Warning>
-These rules apply to all new organizations - those created on or after ENFORCEMENT_DATE_TBD. To minimize disruption to legacy organizations created before that date, we are applying this change gradually. For legacy orgs, your org's credential will still be included with server URLs supplied in the request until the rollout of this rule reaches your org.
+These rules apply to all new organizations - those created on or after ENFORCEMENT_DATE_TBD. To minimize disruption to legacy organizations created before that date, we are applying this change as a phased rollout. For legacy orgs, your org's credential will still be included with server URLs supplied in the request until the rollout reaches your org.
 </Warning>
 
 <Warning>
@@ -420,7 +420,7 @@ assistant this request supplied, not from your org configuration
 The entry is written **once per message type, not once per send**. It is suppressed for the high-volume message types - `model-output`, `speech-update`, `status-update`, `transcript`, `transcript[transcriptType="final"]`, `voice-input`, and `voice-request`.
 
 <Warning>
-Absence of the webhook call log entry on a suppressed type does **not** mean credentials were sent. Credential withholding always happens; only the log entry is suppressed. Check `end-of-call-report`, `call.artifact.upload`, or the session and chat webhooks - at least one of these is logged on every affected call.
+Absence of the webhook call log entry on a suppressed type does **not** mean credentials were sent. Credential withholding always happens on this path; only the log entry is suppressed. Check `end-of-call-report`, `call.artifact.upload`, or the session and chat webhooks - at least one of these is logged on every affected call.
 </Warning>
 
 ## Credential Management