Document the TikTok app setup (org, app, sandbox, review text, demo script)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/tiktok-app.md

@@ -0,0 +1,57 @@
+# TikTok app: Quorla (Metatroncube Software Solutions)
+
+TikTok for Developers → organization **Metatroncube Software Solutions** (ID 7698877273289606165)
+→ app **Quorla** (app ID 7698826121044183061, type "Other").
+Domain **quorlasocial.com** is verified for Production with a DNS TXT record on the HestiaCP server
+(`tiktok-developers-site-verification=bfzo2bR3wIoxwIlvFcNcp3WrDgZs8hfK`). The Sandbox "Quorla testing" uses a second
+record (`tiktok-developers-site-verification=9ndZoztayxekKow8rETQ8yKEvusD5zUJ`). Keep both; record name `@`.
+
+Client key / secret: shown in the app's Credentials panel. Enter them in Quorla under
+Connections → TikTok → Set up. Never paste them into chat, email or Git.
+
+## Production listing (fill in, then submit for review)
+
+TikTok only saves the Production form once the App review section has the explanation and a demo video,
+so these values are kept here until the demo video exists.
+
+| Field | Value |
+|---|---|
+| App icon | `branding/quorla-icon-1024.png` (placeholder; replace with the real logo) |
+| App name | Quorla |
+| Category | Business |
+| Description (≤120) | Agencies schedule and publish approved videos and photo posts to their clients' TikTok accounts. |
+| Terms of Service URL | https://app.quorlasocial.com/terms |
+| Privacy Policy URL | https://app.quorlasocial.com/privacy |
+| Platforms | Web → https://app.quorlasocial.com |
+| Login Kit redirect URI | https://app.quorlasocial.com/oauth/tiktok/callback |
+| Content Posting API | Direct Post on |
+| Scopes | user.info.basic, user.info.profile, user.info.stats, video.publish, video.upload |
+
+### App review explanation (paste into "Explain how each product and scope works")
+
+> Quorla is a social media management tool for marketing agencies. An agency admin connects a client's TikTok
+> account with Login Kit (Connections page → TikTok → Connect). The team then prepares a post in Quorla: uploads
+> the video or photos, writes the caption, and on the TikTok panel sees the connected account's name and avatar,
+> chooses who can view the post (no default is preselected; options come from creator_info), chooses whether to
+> allow comments, Duet and Stitch (off by default, and unavailable when the creator has disabled them), and can
+> disclose commercial content (Your brand / Branded content). An admin reviews and approves the exact post; at the
+> scheduled time Quorla publishes it with the Content Posting API (Direct Post) and shows a link to it.
+>
+> - Login Kit + user.info.basic / user.info.profile: identify the connected account and show its name, username and
+>   avatar so the agency knows which account it is posting to.
+> - user.info.stats: show the account's follower count on the Connections page.
+> - video.upload + video.publish: upload and publish the video or photo post the admin approved. Nothing is posted
+>   without that approval, and Quorla never adds watermarks or promotional branding.
+
+### Demo video (record after deploy, ~2–3 min, screen recording of app.quorlasocial.com)
+
+1. Sign in to Quorla → Connections → TikTok → Connect → TikTok's consent screen → back in Quorla, connected.
+2. Publishing → New post → pick the client → upload a video → caption → tick TikTok.
+3. Show the TikTok panel: account name/avatar, choose audience, comment/Duet/Stitch toggles, commercial content
+   disclosure, Music Usage Confirmation text.
+4. Save as draft → Approve → (set the time 1–2 min ahead) → published → open the post link on TikTok.
+
+## Sandbox (for testing before review)
+
+Use the Sandbox's own client key/secret in Quorla while testing. Add your own TikTok account (and a test client
+account) as **target users**. Sandbox posts are private ("Only me") and accounts must be set to private.