docs: add DESCRIBE_CONFIGS to migrator source topic ACLs (#1770)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Joyce Fee <102751339+Feediver1@users.noreply.github.com>

Author: 3 people

modules/manage/pages/schema-reg/schema-reg-authorization.adoc

@@ -282,9 +282,11 @@ This grants:
 ====
 **Schema Registry ACLs are only for Schema Registry operations.** For complete data migration, you must also use Kafka ACLs:
 
-* **Topics:** READ (source), WRITE/CREATE/DESCRIBE/ALTER (target)
-* **Consumer groups:** READ (source), CREATE/READ (target)
-* **Cluster:** DESCRIBE (both), CREATE (target)
+* **Topics:** `READ`, `DESCRIBE_CONFIGS` (source); `WRITE`/`CREATE`/`DESCRIBE`/`ALTER`/`DESCRIBE_CONFIGS` (target)
+* **Consumer groups:** `READ` (source), `CREATE`/`READ` (target)
+* **Cluster:** `DESCRIBE` (both), `CREATE` (target)
+
+`READ` on a topic implicitly grants `DESCRIBE`, but not `DESCRIBE_CONFIGS`. Redpanda Migrator reads each source topic's configuration (`DESCRIBE_CONFIGS`) to recreate it on the target, so a consumer-only ACL on the source is not sufficient: without `DESCRIBE_CONFIGS` on the source topics, topic creation fails with `TOPIC_AUTHORIZATION_FAILED`.
 
 See xref:manage:security/authorization/acl.adoc[Configure Access Control Lists] for Kafka ACL configuration.
 ====