feat(app): admin module signs the shop in; install finishes like OAuth (1.1.0)

TackQuoteApp/README.md

@@ -233,6 +233,28 @@ TackQuote reads the catalog through the Admin API credentials the shop hands ove
 at registration confirmation. No write scopes are requested, because the app does
 not write back to Shopware yet — see below.
 
+## Admin module: install finishes like OAuth (1.1.0)
+
+`<admin><module>` (and `<main-module>`, the "Open app" button) load
+`https://app.tackquote.com/shopware/app` inside the Shopware Administration.
+Shopware signs that iframe URL with the per-shop secret
+(`shopware-shop-signature`, HMAC-SHA256 of the query), and that signature is the
+sign-in:
+
+1. Install the app. Registration and confirmation run against the TackQuote API,
+   which creates the shop's own TackQuote workspace on the confirmation.
+2. Open **TackQuote** in the Administration. The module verifies the signed
+   query, proves the shop owns the Admin API credentials it handed over (a
+   token request at the shop's own URL), and offers **Open TackQuote**, which
+   opens the workspace signed in, in its own tab.
+
+There is no TackQuote sign-up, password or "claim this shop by id" step. Adding
+a login email, or moving the shop into an existing TackQuote workspace, are
+optional actions in TackQuote under Settings > Security.
+
+Older installs (1.0.0, no `<admin>`) keep working: the API side is compatible
+with them; they get the module after updating the app.
+
 ## Webhooks
 
 | name | event |
@@ -249,9 +271,6 @@ its body is parsed, and compared in constant time.
 
 Stated plainly rather than implied by the manifest:
 
-- **No admin module.** There is no `<admin>` section, so the app adds no UI
-  inside the Shopware administration. A merchant links their store to a
-  TackQuote tenant from the TackQuote seller portal, not from Shopware.
 - **No storefront "Request a Quote" button.** That is template work, and an app
   cannot ship Twig overrides the way `../TackQuote` does. Storefront quoting on
   Cloud needs an App Script or a theme-level change and is not built here.

TackQuoteApp/manifest.xml

@@ -11,7 +11,7 @@
         <description lang="de-DE">Ergaenzt Ihren Storefront um B2B-Angebotsanfragen und synchronisiert Katalog, Kunden und Auftraege mit TackQuote.</description>
         <author>TackQuote</author>
         <copyright>(c) TackQuote</copyright>
-        <version>1.0.0</version>
+        <version>1.1.0</version>
         <license>MIT</license>
         <compatibility>&gt;=6.6.0</compatibility>
         <privacy>https://tackquote.com/privacy</privacy>
@@ -43,6 +43,26 @@
              signature against. -->
     </setup>
 
+    <admin>
+        <!-- The TackQuote admin module. Shopware loads `source` in an iframe and
+             appends a query signed with the PER-SHOP secret (shop-id, shop-url,
+             timestamp, sw-version, ..., shopware-shop-signature). That signed
+             query is the sign-in: app.tackquote.com/shopware/app posts it to
+             POST https://api.tackquote.com/v1/shopware-app/bridge, which
+             verifies it and opens the shop's TackQuote workspace (created on
+             install, no separate TackQuote sign-up or "claim this shop" step).
+             `main-module` puts the same page behind "Open app" in
+             Extensions > My extensions. -->
+        <module name="tackquote"
+                source="https://app.tackquote.com/shopware/app"
+                parent="sw-extension"
+                position="50">
+            <label>TackQuote</label>
+            <label lang="de-DE">TackQuote</label>
+        </module>
+        <main-module source="https://app.tackquote.com/shopware/app"/>
+    </admin>
+
     <permissions>
         <!-- Reads only. TackQuote pulls catalog/customer/order data through the
              Admin API credentials handed over at registration confirmation.
@@ -61,6 +81,13 @@
 
     <allowed-hosts>
         <host>api.tackquote.com</host>
+        <!-- The admin module and main-module iframes load from app.tackquote.com.
+             The manifest reference (developer.shopware.com, manifest-reference,
+             read 2026-10-13) defines allowed-hosts as "the external endpoints your
+             app is allowed to communicate with", and the admin-extension guide
+             shows the install asking the merchant to confirm the module host, so
+             it is listed here rather than left to that prompt. -->
+        <host>app.tackquote.com</host>
     </allowed-hosts>
 
     <webhooks>