feat(plugin): bytedance shared runtime library

[andrexibiza]

What does this PR do?

Adds the ByteDance (TikTok/Douyin) shared runtime library as a standalone plugin. This is the foundation dependency for the TikTok Business Messaging, Douyin Open Platform, and ByteDance operations plugins.

Related Issue

Ref EPIC #86950
Closes #86951

Type of Change

• ✨ New feature (non-breaking change that adds functionality)
• ✅ Tests (adding or improving test coverage)

Changes Made

• Added plugins/bytedance/plugin.yaml (library kind manifest)
• Added plugins/bytedance/shared/ — 10 runtime modules:
  • errors.py — structured provider error envelope
  • http.py — bounded async HTTP client with retry/timeout/redirect cap
  • state.py — profile-scoped SQLite state store (WAL, migrations)
  • webhook.py — HMAC-SHA256 verifier + CompositeIdempotencyKey
  • tokens.py — token broker with single-flight refresh
  • media.py — media broker with SSRF boundary enforcement
  • rate_limit.py — in-memory rate limiter
  • secrets.py — redacted credential storage
  • observability.py — structured logging with redaction
  • approval.py — immutable prepare/approve/commit ledger
• Added contracts (normalized-event.schema.json, publish-intent.schema.json)
• Added 28 unit tests (approval ledger, TikTok webhook, Douyin webhook)

How to Test

# Syntax validation
python -m ast.tools.parse plugins/bytedance/shared/*.py

# Unit tests (when plugins/ is on sys.path)
pytest plugins/bytedance/tests/ -v

Checklist

Code

• Reads Contributing Guide
• Commit messages follow Conventional Commits
• Searched for existing PRs — no duplicates
• PR contains only bytedance-shared library changes
• All Python files pass ast.parse syntax validation
• Added tests (28 unit tests)

Documentation & Housekeeping

• Updated relevant documentation (README.md, SECURITY.md)
• No new env vars or config keys added
• No core tool changes — plugin lives in its own directory

Depends on

Nothing.

Blocks

Lane 2/5 (#86952), Lane 3/5 (#86953)