Fix migration note wording for the removed OAuth timeout

The auth-flow's own HTTP requests are not bounded either, so don't
claim the redirect/callback handlers are the only open-ended waits.

No-Verification-Needed: doc-only wording change

Author: maxisbey

docs/migration.md

@@ -1956,7 +1956,7 @@ Forward the `iss` query parameter from the redirect so the validation can run: o
 
 ### `timeout` parameter removed from `OAuthClientProvider`
 
-`OAuthClientProvider` (and the deprecated `RFC7523OAuthClientProvider`) no longer accept a `timeout` argument, and `OAuthContext.timeout` is gone. The value was stored but never read, so it never bounded anything — the only open-ended waits in the flow are your own `redirect_handler` and `callback_handler`.
+`OAuthClientProvider` (and the deprecated `RFC7523OAuthClientProvider`) no longer accept a `timeout` argument, and `OAuthContext.timeout` is gone. The value was stored but never read, so it never bounded anything — removing it changes no behavior.
 
 **Before (v1):**
 
@@ -1970,7 +1970,7 @@ provider = OAuthClientProvider(server_url, client_metadata, storage, timeout=120
 provider = OAuthClientProvider(server_url, client_metadata, storage)
 ```
 
-If you need to bound how long the flow waits for the user to complete authorization, apply the timeout inside your `callback_handler`, e.g. `with anyio.fail_after(120): ...`.
+If you passed `timeout` to bound how long you wait for the user to complete authorization, apply that bound where you actually wait — inside your `redirect_handler`/`callback_handler`, e.g. `with anyio.fail_after(120): ...`.
 
 ### Client rejects authorization server metadata with a mismatched `issuer`