docs(xaa): XAA trust is read via the dedicated Load XAA settings API

Update the XAAIssuerSettings/XAAJWTBearerSettings docstrings + README to drop
the "returned by the tenant get-settings API" claim - XAA is no longer surfaced
on tenant load; read it via load_xaa_settings / load_all_xaa_settings.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: dorsha

README.md

@@ -1811,7 +1811,7 @@ descope_client.mgmt.third_party_application.delete_batch([app_id])
 
 ### Manage Cross-App Access (XAA / ID-JAG)
 
-Cross-App Access (XAA), built on the OAuth identity-assertion authorization grant (ID-JAG), lets a tenant trust external OIDC issuers so a token minted by a trusted issuer can be exchanged for a Descope token (the RFC 7523 `jwt-bearer` grant). XAA trust is configured **per SSO configuration** of a tenant through the SSO management API, addressed by its `sso_id` (omit it, or pass an empty string, for the tenant's default SSO configuration). The trusted issuers are set together with the config-level shared group/role mapping. The exported `XAASettings`, `XAAJWTBearerSettings`, and `XAAIssuerSettings` classes describe the write payload; the same issuer shape is returned under a tenant's `idJagSettings` by the tenant get-settings API.
+Cross-App Access (XAA), built on the OAuth identity-assertion authorization grant (ID-JAG), lets a tenant trust external OIDC issuers so a token minted by a trusted issuer can be exchanged for a Descope token (the RFC 7523 `jwt-bearer` grant). XAA trust is configured **per SSO configuration** of a tenant through the SSO management API, addressed by its `sso_id` (omit it, or pass an empty string, for the tenant's default SSO configuration). The trusted issuers are set together with the config-level shared group/role mapping. The exported `XAASettings`, `XAAJWTBearerSettings`, and `XAAIssuerSettings` classes describe the write payload; the same shape is returned by the dedicated Load XAA settings API (`load_xaa_settings` / `load_all_xaa_settings`), not on tenant load.
 
 ```python
 from descope import AttributeMapping, RoleMapping, XAAIssuerSettings, XAAJWTBearerSettings, XAASettings

descope/management/sso_settings.py

@@ -59,8 +59,8 @@ class XAAIssuerSettings:
     """
     Cross-App Access (XAA / ID-JAG) trusted-issuer settings, including per-issuer JIT provisioning and
     user attribute mapping (parity with the SSO login JIT). Group-to-role mapping reuses the tenant's
-    shared SSO group mapping. Describes the shape of each entry under a tenant's ``idJagSettings.issuers``
-    map, as returned by the tenant get-settings API.
+    shared SSO group mapping. Describes the shape of each entry under the trust config's ``issuers`` map,
+    as returned by the dedicated Load XAA settings API (``load_xaa_settings`` / ``load_all_xaa_settings``).
     """
 
     def __init__(
@@ -83,8 +83,9 @@ def __init__(
 class XAAJWTBearerSettings:
     """
     A tenant's Cross-App Access (XAA / ID-JAG) trust config: the set of trusted issuers keyed by issuer
-    URL, plus the jwt-bearer grant configuration. Returned as ``idJagSettings`` by the tenant
-    get-settings API and used as the ``settings`` field of the XAA configure request.
+    URL, plus the jwt-bearer grant configuration. Used as the ``settings`` field of the XAA configure
+    request, and returned under ``settings`` by the dedicated Load XAA settings API
+    (``load_xaa_settings`` / ``load_all_xaa_settings``).
     """
 
     def __init__(