[Internal]: Document PrivateLink endpoint support for Fleet Server and ES output in serverless

### Description

Fleet is adding support to use PrivateLink for fleet server hosts and output to Serverless. We need to document how the feature works.

The feature will be released to serverless as soon as possible (at the time of writing, July 1st) as the ticket has very high priority.

How it works - I added a video to the PR description
- The user can set up a privateLink in serverless (that's an existing feature - I was told that for now available for AWS only but needs to be checked):

- Once that is setup, in fleet settings the user will be able to see the new fleet server host and output and set them as default
- The user will be able to update the defaults per policy as well
- If the privateLink is removed, Fleet reverts to the Elastic defaults.

### Resources

Implemented in PR: https://github.com/elastic/kibana/pull/275601.
Related to https://github.com/elastic/enhancements/issues/28498

Existing docs:
- https://www.elastic.co/docs/deploy-manage/security/private-connectivity-aws#aws-privatelink-and-fleet
- https://www.elastic.co/docs/reference/fleet/fleet-agent-serverless-restrictions#fleet-server-serverless-restrictions - this will need to be updated

### Which deployment methods does this change impact?

Elastic Cloud Serverless only

### Feature differences

_No response_

### What Elastic Stack release is this request related to?

N/A

### Serverless release

_No response_

### Collaboration model

The documentation team will create the first draft

### Point of contact.

**Main contact:** @criamico

**Stakeholders:**

---

## Elastic Docs AI Scoping 🤖

Docs issue scope

### Summary
The issue asks for docs on AWS PrivateLink support for Fleet Server hosts and ES output in \{\{serverless-full}}. The linked, merged PR ([kibana#275601](https://github.com/elastic/kibana/pull/275601)) confirms this: when a project has PrivateLink enabled, Kibana now injects a `private-fleet-server` host and `es-private-output` output via preconfiguration, exposes them in **Fleet → Settings** (with a "AWS PrivateLink" badge) where the URL is fixed but `is_default` can be toggled, and exposes both as selectable, per-policy overrides in an agent policy's advanced settings. If PrivateLink is later disabled/removed from the project, Kibana automatically reverts the default back to the public serverless host/output and deletes the private entities.

### Request accuracy
Accurate, with one nuance to add: the private host/output name and URL are **not editable** by the user (only `is_default` can be toggled in Settings, plus per-policy selection in Advanced settings) — everything else is provisioned externally by the project controller.

### Next action for author
Update the existing serverless-restrictions and PrivateLink/Fleet-settings pages listed below; no new page is needed.

### Impact: High

### Scope boundary
No changes needed to on-premises/\{\{ech}} Fleet Server or output docs — this is serverless-only, and Azure/GCP variants are not yet implemented (code has provider-label logic for Azure/GCP but the feature is currently enabled for AWS only per the issue).

### Recommended documentation targets

| Page | URL | Action | Impact | Confidence | Why this page? |
|------|-----|--------|--------|------------|----------------|
| \{\{fleet}} and \{\{agent}} restrictions for \{\{serverless-full}} | `/reference/fleet/fleet-agent-serverless-restrictions.md` | Update existing page | High | High | Explicitly named in the issue; the current "Fleet Server host URL is fixed" and "ES output URL is fixed" restriction statements are now the *default* case, not absolute — needs a carve-out for PrivateLink-enabled projects. |
| Private connectivity with AWS PrivateLink | `/deploy-manage/security/private-connectivity-aws.md` (via shared include `_snippets/private-connection-fleet.md`) | Update section (via shared snippet) | Medium | Medium | The "AWS PrivateLink and Fleet" section currently describes manual `kibana.yml`-only configuration, which no longer reflects serverless: the private host/output now appear automatically in the UI. Because this snippet is shared with the Azure/GCP private-connectivity pages (where this automation doesn't yet apply), it needs an `applies_to`/`applies-switch` branch rather than a blanket rewrite. |
| \{\{fleet}} settings | `/reference/fleet/fleet-settings.md` | Add section (Fleet Server host settings + Output settings) | High | High | This is the page that documents the **Settings** tab where the private host/output actually appear, get their provider badge, and can be set as default — no existing content describes this automatic PrivateLink row. |
| \{\{agent}} policies | `/reference/fleet/agent-policy.md` | Add section | Medium | Medium | No existing section documents per-policy Fleet Server host / output overrides via **Advanced settings**; the PR adds a private option there. Confidence is medium because exact gating (e.g., whether this per-policy selector requires a specific subscription tier, unlike the existing licensed "per policy output assignment") wasn't visible in the diff and should be confirmed with `@criamico`. |

### Recommendations

1. Update [\{\{fleet}} and \{\{agent}} restrictions for \{\{serverless-full}}](/reference/fleet/fleet-agent-serverless-restrictions.md) — in both the **Outputs** and **\{\{fleet-server}}** subsections, add a note that if AWS PrivateLink is enabled for the project, a private Fleet Server host and ES output are available and can be used instead of the fixed default.
2. Update the shared snippet `_snippets/private-connection-fleet.md` (included by the AWS/Azure/GCP private-connectivity pages) to branch by `applies_to`/`applies-switch`: keep the manual `kibana.yml` steps for \{\{ech}}, and add serverless-specific guidance that the private host/output are provisioned automatically and surfaced in **Fleet → Settings**.
3. Add a subsection to [\{\{fleet}} settings](/reference/fleet/fleet-settings.md) describing the PrivateLink-provisioned Fleet Server host and output: how they appear (with provider badge), that only `is_default` is editable, and that removing PrivateLink reverts to the default and deletes the private entities.
4. Add a subsection to [\{\{agent}} policies](/reference/fleet/agent-policy.md) describing the per-policy override of Fleet Server host / output in **Advanced settings** when a private option is available.

### Notes

- Item 2 needs care because the destination snippet is shared across three cloud-provider pages, only one of which (AWS) currently ships this behavior — don't apply the update to Azure/GCP without confirming their rollout status first.
- Item 4's exact subscription/licensing gating for the per-policy selector isn't confirmed from the code alone; verify with `@criamico` before publishing.
- The issue's video and the PR's testing steps (in the PR description) are the best source for exact UI screenshots/labels when drafting.

> Generated by [Issue Scope Analyzer](https://github.com/elastic/docs-content/actions/runs/30107210667) for #7167 · sonnet 214 AIC · ⌖ 6.22 AIC · ⊞ 690 · [◷](https://github.com/search?q=repo%3Aelastic%2Fdocs-content+is%3Aissue+%22gh-aw-workflow-call-id%3A+elastic%2Fdocs-content%2Fgh-aw-docs-issue-scope%22&type=issues)