TikTok API: 2h tokens, rotating refresh, HTTP 200 errors

TikTok's OAuth pages changed on 2026-11-02: access tokens now last 2 hours (was 24h), and refresh tokens last 180 days (was 365) and ROTATE, so each refresh invalidates the previous refresh token. Use expires_in/refresh_expires_in, because the docs' example JSON still shows the old values. With rotation, a lost or raced refresh means the user must reconnect (Composio marks the account EXPIRED). Also, /v2/post/publish/creator_info/query/ returns spam_risk_too_many_posts, spam_risk_user_banned_from_posting and reached_active_user_cap with HTTP 200 and error.code != 'ok', so a wrapper that unwraps {data, error} and drops error will treat a blocked creator as OK. Always check error.code.