docs: streamline camp endings and fix typo

Author: dbarkol

docs/camps/base-camp.md

@@ -542,39 +542,20 @@ Start with **Waypoint 1** and work through each waypoint in order. By the end, y
     :material-check: **RBAC** - Role-based access control for fine-grained permissions  
     :material-check: **Audit logging** - Track every access for compliance  
 
-## Summary & Key Takeaways
+## Base Camp Recap
 
-!!! success "What You've Learned"
-    **Vulnerability Demonstrated:** Unauthenticated MCP servers expose all data  
-    **OWASP Risk:** MCP07 - Insufficient Authentication & Authorization  
-    **Fix Applied:** Token-based authentication on every request  
-    **Pattern Learned:** The "vulnerable → exploit → fix → validate" methodology
-
-### What's Next in Camp 1?
-
-Base Camp used simple bearer tokens for demonstration. **Camp 1: Identity & Access Management** will upgrade to production-grade security:
-
-- **OAuth 2.1** with PKCE (S256 method)
-- **Azure Managed Identity** for passwordless authentication
-- **Azure Key Vault** for secrets management
-- **RBAC** for least-privilege access control
-
-Then **Camp 2: Gateway & Network Security** will add centralized API/MCP Gateway protection with Azure API Management.
+| What You Validated | Outcome |
+|--------------------|---------|
+| Vulnerability | Unauthenticated MCP access exposed all user data |
+| OWASP risks | MCP01 (Token Mismanagement), MCP07 (Insufficient Auth) |
+| Security fix | Token-based authentication + per-user authorization |
+| Validation method | Automated exploit and secure tests (`test_vulnerable.py`, `test_secure.py`) |
+| Core pattern | vulnerable → exploit → fix → validate |
 
 ---
 
-## Additional Resources
-
-!!! tip "Learn More"
-    **Source Code:** All code is available in the [GitHub repository](https://github.com/Azure-Samples/sherpa/tree/main/camps/base-camp)
-    
-    **OWASP Guide References:**
-    
-    - [MCP01: Token Mismanagement & Secret Exposure](https://microsoft.github.io/mcp-azure-security-guide/mcp/mcp01-token-mismanagement/)
-    - [MCP07: Insufficient Authentication & Authorization](https://microsoft.github.io/mcp-azure-security-guide/mcp/mcp07-authz/)
+[Continue: Camp 1 Identity & Access Management →](camp1-identity.md){ .md-button .md-button--primary }
 
 ---
 
-**Ready to continue the ascent?** Head to [Camp 1: Identity & Access Management](camp1-identity.md) →
-
-*Base Camp complete! You've learned the fundamentals. Now let's climb higher.* 🏔️
+← [Prerequisites](../prerequisites.md) | [Camp 1: Identity & Access Management](camp1-identity.md) →

docs/camps/camp1-identity.md

@@ -831,7 +831,7 @@ Camp 1 follows six waypoints, each building on the previous one. Click each wayp
 
     ---
 
-    ??? example "Option A: Device Code Flow (Understaning OAuth)"
+    ??? example "Option A: Device Code Flow (Understanding OAuth)"
 
         **Best for:** Learning OAuth mechanics, CLI automation, headless environments
 
@@ -1406,85 +1406,7 @@ az ad app delete --id $APP_ID
 
 ---
 
-## Next Steps
-
-### Immediate Actions
-
-- Review your own MCP servers for token exposure
-- Migrate hardcoded secrets to Key Vault
-- Implement OAuth 2.1 for production servers
-- Apply least-privilege RBAC everywhere
-
-### Continue the Journey
-
-Ready for the next challenge? Proceed to:
-
-**[Camp 2: Gateway & Network Security →](camp2-gateway/index.md)**
-
-Learn about:
-
-- Gateway patterns for MCP
-- Rate limiting and throttling
-- Network security controls
-- DDoS protection
-- Traffic monitoring
-
----
-
-## Additional Resources
-
-- [Azure Managed Identity Documentation](https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/)
-- [Azure Key Vault Best Practices](https://learn.microsoft.com/azure/key-vault/general/best-practices)
-- [OAuth 2.1 Specification](https://oauth.net/2.1/)
-- [OWASP MCP Azure Security Guide](https://microsoft.github.io/mcp-azure-security-guide/)
-- [FastMCP Authentication Documentation](https://github.com/jlowin/fastmcp)
-
----
-
-## Troubleshooting
-
-??? question "Issue: azd up fails with subscription access error"
-    **Solution:** Ensure you're logged in with correct subscription:
-    ```bash
-    az login
-    az account set --subscription "<your-subscription-id>"
-    azd auth login
-    ```
-
-??? question "Issue: Token acquisition fails"
-    **Solution:** Ensure you're logged in with `az login` and have correct app registration:
-    ```bash
-    az login
-    # Verify tenant
-    az account show --query tenantId -o tsv
-    # Re-run registration if needed
-    ./scripts/register-entra-app.sh
-    ```
-
-??? question "Issue: Key Vault access denied"
-    **Solution:** Verify Managed Identity has "Key Vault Secrets User" role:
-    ```bash
-    ./scripts/enable-managed-identity.sh
-    # Check role assignments
-    azd env get-values | grep AZURE_MANAGED_IDENTITY_PRINCIPAL_ID
-    ```
-
-??? question "Issue: JWT validation fails with 'Invalid audience'"
-    **Solution:** Ensure AZURE_CLIENT_ID matches your Entra ID app:
-    ```bash
-    azd env get-values | grep -E "AZURE_CLIENT_ID|AZURE_TENANT_ID"
-    # Verify these match your app registration in Azure Portal
-    ```
-
-??? question "Issue: Can't find deployed container app URL"
-    **Solution:** Get deployment information:
-    ```bash
-    azd env get-values | grep URL
-    # Or check in Azure Portal:
-    # Resource Group → Container App → Overview → Application Url
-    ```
-
----
+[Continue: Camp 2 Gateway Security →](camp2-gateway/index.md){ .md-button .md-button--primary }
 
 ---