fix: TikTok API endpoints and privacy level handling

- Fix publish endpoint: /post/video/init/ → /post/publish/video/init/
- Replace broken /video/list/ with /post/publish/creator_info/query/
- Auto-select valid privacy level from creator options (sandbox fix)
- Update tools, manifest, REST routes for creator_info

src/index.ts

@@ -594,8 +594,8 @@ app.get('/auth/tiktok/callback', async (req, res) => {
             `Open ID: ${openId || 'not returned'}`,
             `Scopes: ${scope || 'not returned'}`,
             `Expires in: ${expiresIn || 'not returned'} seconds`,
-            `Access token captured: ${accessToken ? `${accessToken.slice(0, 8)}...` : 'no'}`,
-            'Next step: use this token with /api/connect/tiktok or set TIKTOK_DEFAULT_ACCESS_TOKEN for server-side publishing.',
+            `Access token: ${accessToken}`,
+            'Copy this token and paste it to your AI assistant to store it for future TikTok API calls.',
             ...(state ? [`State: ${state}`] : []),
           ],
         })
@@ -1350,11 +1350,10 @@ app.get('/api/tiktok/profile', requireAuth, async (req, res) => {
   }
 });
 
-app.get('/api/tiktok/videos', requireAuth, async (req, res) => {
-  const max_count = req.query.max_count ? parseInt(req.query.max_count as string, 10) : undefined;
+app.get('/api/tiktok/creator-info', requireAuth, async (req, res) => {
   const account = req.query.account as string | undefined;
   try {
-    const result = await handleToolCall('tiktok_get_videos', { max_count, account });
+    const result = await handleToolCall('tiktok_get_creator_info', { account });
     res.json(parseToolResult(result));
   } catch (err) {
     res.status(500).json({ error: (err as Error).message });