Cluster access migration lab assumes aws-auth access but workshop cluster is API-only

### Problem

The Cluster Access Management migration lab appears to assume the workshop cluster is still using `API_AND_CONFIG_MAP` authentication and that the `eks-workshop-admins` IAM role is initially authorized through the `aws-auth` ConfigMap. In the current workshop environment, the cluster reports API-only authentication instead.

The docs page at https://www.eksworkshop.com/docs/security/cluster-access-management/managing shows this expected output:

```json
{
"authenticationMode": "API_AND_CONFIG_MAP"
}
```

However, in a fresh workshop environment the command returns:

```bash
$ aws eks describe-cluster --name $EKS_CLUSTER_NAME --query 'cluster.accessConfig'\n{\n "authenticationMode": "API"\n}\n```\n\n### Reproduction\n\nFollow the migration page: https://www.eksworkshop.com/docs/security/cluster-access-management/migrating\n\nRun:\n\n```bash\naws eks update-kubeconfig --name $EKS_CLUSTER_NAME \\\n --role-arn $ADMINS_IAM_ROLE --alias admins --user-alias admins\n\nkubectl --context admins get pod -n carts\n```\n\n### Expected behavior\n\nThe page says this should list pods in the `carts` namespace before deleting the `aws-auth` identity mapping.\n\n### Actual behavior\n\nThe command fails immediately:\n\n```text\nerror: You must be logged in to the server (Unauthorized)\n```\n\n### Suspected cause\n\nBecause the cluster is already in `API` authentication mode, it no longer uses `aws-auth` for authentication. The migration lab is specifically about migrating an IAM role from `aws-auth` to EKS access entries, so the initial validation step only works if the environment still has `API_AND_CONFIG_MAP` enabled and the `eks-workshop-admins` mapping is present/effective.\n\nThis makes the migration lab difficult to follow in the current hosted workshop environment: the user reaches the same Unauthorized state that the guide says should only happen after deleting the `aws-auth` identity mapping.\n\n### Suggested fix\n\nEither update the lab environment so this section starts with `authenticationMode: API_AND_CONFIG_MAP`, or update the migration page to explain that API-only clusters should skip/adjust this migration path and create/associate the access entry for `$ADMINS_IAM_ROLE` before validating `kubectl --context admins` access.

Start with the managing and migrating pages linked in the issue, then run the described aws eks describe-cluster and kubectl commands in a fresh workshop environment. Confirm whether the lab or environment must provide API_AND_CONFIG_MAP access; done means the migration steps no longer produce an unexpected Unauthorized error and clearly cover API-only clusters.

Written by the indexing model from the issue text.