Add shiply to your product

You are adding a "Publish with shiply" button to THIS product.
shiply.now is a hosting backend: when someone clicks the button they publish
into their OWN shiply account (their billing, their control), and the owner of
this product earns 30% of what they pay, every month, for their first 12 months.

STEP 0 — Ask me these two questions FIRST, then wait for my answers. Do not
write any code until you have both:
  1. Which page or screen should show the "Publish with shiply" button?
     Give me the file/route AND the public URL it's served at — e.g.
     "the dashboard, app/dashboard/page.tsx, live at https://myapp.com/dashboard".
  2. What is this app's public base URL? You'll add an OAuth callback route to
     it — e.g. https://myapp.com/api/shiply/callback.
If either answer is missing or unclear, ask me — never guess the page or the URL.

STEP 1 — Apply for a client_id.
POST https://shiply.now/api/v1/integrate/apply
Content-Type: application/json
{
  "name": "<this product's name>",
  "slug": "<a-url-slug>",                 // becomes shiply.now/connect/<slug>
  "redirect_uris": ["<the callback URL from step 0>"],
  "logoUrl": "<optional logo URL>",
  "use_case": "<one line: what this product is>"
}
-> 201 { "client_id": "mcpc_...", "slug": "<slug>", "status": "pending" }
-> 409 if the slug is taken — pick another and retry
-> 400 { "error": { "code", "message" } } if a redirect_uri is invalid
An admin approves by hand; the client_id activates on approval (the owner gets
an email). If you already applied, don't re-apply — wait for the approval.

STEP 2 — Put the button on the page I named in step 0.
Add it to that page, linking to the connect URL with a FRESH PKCE pair per
click, with the href built server-side:
https://shiply.now/connect/<slug>?response_type=code&redirect_uri=<callback-url>&code_challenge=<S256-of-code_verifier>&code_challenge_method=S256&state=<random-state>
Use the hosted asset so it matches shiply's brand:
  <a href="<the connect URL above>">
    <img src="https://shiply.now/button/publish-with-shiply.svg" alt="Publish with shiply" height="40" />
  </a>
Generate code_verifier + state per click and store code_verifier server-side
keyed by state (or a short-lived cookie) — you need it back at the callback.

STEP 3 — Build the callback route at the URL from step 0.
Verify state matches what you stored, then:
POST https://shiply.now/api/v1/oauth/token
{
  "grant_type": "authorization_code",
  "code": "<code from the callback>",
  "code_verifier": "<the one you stored for this state>",
  "redirect_uri": "<callback-url>",
  "client_id": "<your client_id>"
}
-> { "access_token", "refresh_token", "scope": "platform:sites" }
Encrypt both tokens at rest, one pair per connected user. Refresh with
grant_type=refresh_token every session (refresh_token lasts 90 days from last use).

STEP 4 — Publish on the user's behalf.
Authorization: Bearer <access_token> on:
POST /api/v1/publish                 — ship a new version
GET  /api/v1/sites/<slug>/files      — pull the current files
GET  /api/v1/sites/<slug>/versions   — list versions
GET  /api/v1/me/entitlements         — the user's plan/limits
Scope rule: this token can only touch sites it created through this button —
never any other site on the user's account. Every shiply error is JSON with a
code, a message, and a docs pointer — follow it, don't guess at the fix.

When you're done, tell me in plain English what you built and which page the
button now lives on, plus this line I can hand my admin: "Users click Publish
with shiply, sign up and pay on shiply.now (not through us), and we get a token
that can only publish the sites they make through us — shiply pays us 30%
monthly for their first year. We never see their password or card."