docs(mcp-data-app): warn that duplication copies #MCP_PUBLIC_URL (SUPPORT-17219)

[ZoraJel]

Summary

Documents a real-world failure mode of the mcp-data-app skill: duplicating an MCP data-app config in the Keboola UI copies all secrets verbatim, including #MCP_PUBLIC_URL. The copy then advertises the source app's origin in its OAuth-shape discovery docs (/.well-known/oauth-authorization-server), so it deploys and runs fine, but a fresh client's OAuth handshake reads discovery from the new app and then redirects to the old app's /authorize, and fails.

Because #MCP_PUBLIC_URL drives the advertised issuer/authorization_endpoint/token_endpoint, and the app itself boots regardless of its value, this is invisible from the outside — only a new client setting up a fresh connection breaks. troubleshooting.md previously covered only the empty #MCP_PUBLIC_URL case (discovery showing 127.0.0.1:5000), not the stale/copied one.

Docs-only, two files:

• reference/troubleshooting.md — new symptom→cause→fix row for the stale/copied value.
• reference/deploy.md §Two-pass — note that #MCP_PUBLIC_URL is instance-specific, duplication copies it, and the two-pass dance must be re-run on any duplicated app before connecting a client.

Fix in both places is the same: reset #MCP_PUBLIC_URL to the copy's own URL and redeploy.

Surfaced from SUPPORT-17219.

Link to Devin session: https://app.devin.ai/sessions/439e811f308041028b0f492b2d66f2c8
Requested by: @ZoraJel

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring