Adapter: TikTok Shop Seller (Open API 202309) with its own shop authorization #1522

Summary

Add a TikTok Shop Seller catalog connector on the TikTok Shop Open API (Partner Center, API version 202309): orders, fulfillment (ship package, tracking), products (list, get, create, edit), inventory, for one authorized shop. Catalog search shows recurring demand for "tiktok shop"; the existing tiktok-ads adapter covers advertising only.

Why this touches authentication

TikTok Shop does not use standard OAuth 2:

• Every call is signed: hex(HMAC-SHA256(app_secret, app_secret + path + sorted(key+value of query params except sign/access_token) + body + app_secret)), sent as the sign query parameter, with app_key and timestamp. The extended HMAC options from Shopee Seller connector, query-signed HMAC and Shopee token refresh #1147/Add AliExpress Affiliate and Dropshipping connectors with IOP request signing #1346 (placement: query, ${pathname}, ${sortedParams}) should express this without engine changes.
• The seller authorizes the app in TikTok Shop, which redirects back with code. The code is exchanged with a GET on https://auth.tiktok-shops.com/api/v2/token/get (app_key, app_secret, auth_code, grant_type=authorized_code); /api/v2/token/refresh renews. The response is wrapped in {code, message, data}; expiry fields are Unix timestamps.
• The access token goes in the x-tts-access-token header, not Authorization.
• Shop calls need shop_cipher, read from GET /authorization/202309/shops after authorization.

So this needs a token provider like ShopeeTokenService (authConfig.tokenProvider: "tiktok-shop"): code exchange, renewal before expiry, one renewal per connector under an advisory lock, needs_reauth plus one email when the refresh token is refused, its own authorize/callback/complete endpoints, and the "Authorize with Provider" card in the dashboard. Nothing else changes for existing connectors.

Credentials: Cloud and self-hosted

• The seller's own app (both modes): the user pastes the App Key and App Secret of a TikTok Shop custom app (Partner Center seller developer) into the connector, sets the app's redirect URL to <SERVER_URL>/api/tiktok-shop/callback, and authorizes the shop. TikTok only lets sellers with an assigned account manager register custom apps, so this suits a minority of sellers.
• AnythingMCP's public app (Cloud, later): once our own TikTok Shop app passes TikTok's review, Cloud can offer it so sellers only authorize. Out of scope for the first PR; the provider should not preclude it.

Scope of the first PR

• Token provider, endpoints, dashboard card, setup-status handling (as in Shopee Seller connector, query-signed HMAC and Shopee token refresh #1147).
• Adapter intl/tiktok-shop.json with read tools (shop, orders, order detail, products, product detail, warehouses, shipping providers, packages, returns) and write tools installed switched off (ship package / update tracking, create and edit product, update inventory, update price).
• Static spec plus RUN_TIKTOK_SHOP_LIVE=1 live spec, catalog regeneration, adapter counts, logo, docs.