fix: stabilize post-MVP travel-agent and itinerary workflows

documentation/docs/configuration/advanced_configuration.md

@@ -9,4 +9,15 @@ In addition to the primary configuration variables listed above, there are sever
 | `SOCIALACCOUNT_ALLOW_SIGNUP` | No       | When set to `True`, signup will be allowed via social providers even if registration is disabled.                                                                                          | `False`       | Backend           |
 | `OSRM_BASE_URL`             | No       | Base URL of the OSRM routing server used for itinerary connector distance/travel-time metrics. The public OSRM demo server is used by default. Set this to point at your own OSRM instance (e.g. `http://osrm:5000`) for higher rate limits or offline use. When the OSRM server is unreachable, the backend automatically falls back to haversine-based approximations so the itinerary UI always shows metrics. | `https://router.project-osrm.org` | Backend           |
 | `FIELD_ENCRYPTION_KEY`      | No*      | Fernet key used to encrypt user API keys at rest (integrations API key storage). Generate a 32-byte urlsafe base64 key (e.g. `python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"`). If missing/invalid, only API-key storage endpoints fail gracefully and the rest of the app remains available. | _(none)_ | Backend |
-| `DJANGO_MCP_ENDPOINT`       | No       | HTTP path used for Django MCP server streamable endpoint.                                                                                                                                    | `api/mcp`     | Backend           |
+| `DJANGO_MCP_ENDPOINT`       | No       | HTTP path used for the Voyage Travel Agent MCP endpoint. Clients call this endpoint with `Authorization: Token <token>` using a DRF auth token for the target user account.                                                        | `api/mcp`     | Backend           |
+
+## MCP endpoint authentication details
+
+Voyage's MCP endpoint requires token authentication.
+
+- Header format: `Authorization: Token <token>`
+- Default endpoint path: `api/mcp`
+- Override path with: `DJANGO_MCP_ENDPOINT`
+- Token bootstrap endpoint for authenticated sessions: `GET /auth/mcp-token/`
+
+For MCP usage patterns and tool-level examples, see the [Travel Agent (MCP) guide](../guides/travel_agent.md).

documentation/docs/configuration/updating.md

@@ -1,6 +1,25 @@
 # Updating
 
-Updating Voyage when using docker can be quite easy. Run the following commands to pull the latest version and restart the containers. Make sure you backup your instance before updating just in case!
+Updating Voyage when using docker can be quite easy. Run a collections backup before upgrading, then pull the latest version and restart the containers.
+
+## Pre-upgrade backup (recommended)
+
+Before running migrations or updating containers, export a collections snapshot:
+
+```bash
+docker compose exec server python manage.py export_collections_backup
+```
+
+You can also provide a custom output path:
+
+```bash
+docker compose exec server python manage.py export_collections_backup --output /code/backups/collections_backup_pre_upgrade.json
+```
+
+The backup file includes a timestamp, record counts, and snapshot data for:
+
+- `Collection`
+- `CollectionItineraryItem`
 
 Note: Make sure you are in the same directory as your `docker-compose.yml` file.