chore: sync II spec to dfinity/internet-identity release-2026-08-14 (#345)

## Summary

Automated sync of the Internet Identity specification from
`dfinity/internet-identity`.

**Release:** `release-2026-08-14`  (pinned from `c78d1b9` → `21ab317d`)

**Changed upstream files:**
- `src/internet_identity/internet_identity.did`

- Ran `npm run sync:ii-spec` — regenerated
`docs/references/internet-identity-spec.md` and
`docs/references/verifiable-credentials-spec.md`
- Build passed ✓

## Checklist

- [ ] Review the diff to `docs/references/internet-identity-spec.md` for
content changes
- [ ] Review the diff to
`docs/references/verifiable-credentials-spec.md` for content changes
- [ ] Check for new absolute `internetcomputer.org` link patterns
(script exits non-zero if any were missed)
- [ ] Verify any renamed or restructured sections are reflected
correctly

## Sync recommendation

`sync from dfinity/internet-identity — docs/ii-spec.mdx,
docs/vc-spec.md, src/internet_identity/internet_identity.did`

Co-authored-by: pr-automation-bot-public[bot] <pr-automation-bot-public[bot]@users.noreply.github.com>

Author: pr-automation-bot-public[bot]

.sources/VERSIONS

@@ -62,4 +62,4 @@ motoko-core           v2.4.0
 cdk-rs                ic-cdk v0.20.1 / ic-cdk-timers v1.0.0 / ic-cdk-executor v2.0.0  317f55c
 candid                2025-12-18  # candid v0.10.20, didc v0.5.4                2e4a2cf
 response-verification v3.1.0                                                    18c5a37
-internetidentity      release-2026-08-07                                         c78d1b99
+internetidentity      release-2026-08-14                                         21ab317d

.sources/internetidentity

@@ -1026,6 +1026,13 @@ type IdentityInfo = record {
     // shows a "limit reached" notice in the wizard when adding
     // beyond the cap.
     verified_emails : opt vec VerifiedEmail;
+    // The anchor's synced trusted-MCP-server config (absent when the
+    // anchor never wrote one). Carried here rather than read from the
+    // mcp_get_config query so the Settings UI has a certified value to
+    // render and to base its writes on: identity_info is an update
+    // call, so its response is certified through consensus, whereas a
+    // query reply a single malicious node could forge is not.
+    mcp_config : opt McpConfig;
 };
 
 type IdentityInfoError = variant {
@@ -1876,9 +1883,13 @@ service : (opt InternetIdentityInit) -> {
 
     // Read the identity's synced trusted-MCP-server config (master toggle + the
     // trusted server URL). Persisted on-chain, so it follows the identity across
-    // devices. Read by the Settings UI and the /mcp connect flow (which verifies
-    // the connecting origin against it). Returns the disabled, no-server default
-    // for an unauthorized caller or an anchor that never wrote a config.
+    // devices. Being a query, the reply is signed by a single node: the /mcp
+    // connect flow uses it only to pick which screen to show, and gates delivery
+    // on the certified trusted_url from prepare_mcp_registration_delegation.
+    // Callers that render trust, or write the config back, take it from
+    // IdentityInfo.mcp_config on the identity_info update call instead. Returns
+    // the disabled, no-server default for an unauthorized caller or an anchor
+    // that never wrote a config.
     // `null` means the identity has never written a config — distinct from a
     // stored one that is switched off. The two behave differently at /mcp: the
     // first may connect the deployment's official connector (completing the