VAP15-53 docs: set the enforcement cutoff to 2026-09-23

Replaces the ENFORCEMENT_DATE_TBD placeholder and drops the TODO that
guarded it. Unblocks merge.

VAPSEC-689 deploys on Monday 2026-09-21. The date is stated in UTC
because 2026-09-23T00:00:00Z is Tuesday 5pm Pacific: a cutoff written
as "2026-09-22" would have landed Monday 5pm Pacific, the same day as
the deploy and possibly before it, which trips the cutoff-ahead-of-
BUILD_DATE invariant that PR #19995 machine-checks. Wednesday UTC
leaves roughly thirty hours of margin and survives a Monday slip.

The (UTC) marker is there because the boundary is an instant, not a
calendar day. An org created Tuesday 5pm Pacific is created on
2026-09-23 UTC and is enforced, while its owner believes they signed
up on the 22nd.

This date must stay in sync with WEBHOOK_CREDENTIAL_BINDING_CUTOFF.
Fern cannot interpolate it, so a cutoff change needs a companion docs
PR. Recorded on VAPSEC-689.

Refs VAP15-53, VAPSEC-689

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: jeffrey-hoekman-vapi

fern/server-url/server-authentication.mdx

@@ -395,12 +395,8 @@ This applies when the API request server URL comes from:
 
 It does **not** apply to a saved assistant, phone number, or tool, or to your org's Server Configuration - those keep their credentials.
 
-{/* TODO(VAP15-53): replace ENFORCEMENT_DATE_TBD with the VAPSEC-689 cutoff date
-    (WEBHOOK_CREDENTIAL_BINDING_CUTOFF) once CISO / infosec / EM sign off. Do not merge
-    with the placeholder in place. */}
-
 <Warning>
-These rules apply to all new organizations - those created on or after ENFORCEMENT_DATE_TBD. To minimize disruption to legacy organizations created before that date, we are applying this change as a phased rollout. For legacy orgs, your org's credential will still be included with server URLs supplied in the request until the rollout reaches your org.
+These rules apply to all new organizations - those created on or after 2026-09-23 (UTC). To minimize disruption to legacy organizations created before that date, we are applying this change as a phased rollout. For legacy orgs, your org's credential will still be included with server URLs supplied in the request until the rollout reaches your org.
 </Warning>
 
 <Warning>