A hosted MCP server dropped our session every 30 minutes. Running it ourselves fixed it - and revealed three Google OAuth traps nobody documents.