refactor: enforce layer discipline — move repositories, fix constructor injection

- Move HelpdeskTenantSettingsRepository and HelpdeskTokenRepository from
  Service/ to Repository/ directory (GR-SEC-003: SQL only in repositories)
- Make AccessControl constructor require IntendedUrlService explicitly
  instead of falling back to `new IntendedUrlService()` (GR-TEST-002:
  no service instantiation outside factories)
- Update all imports and tests accordingly

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lib/Http/AccessControl.php

@@ -22,7 +22,7 @@ class AccessControl
     private array $configuredPublicPaths;
     private IntendedUrlService $intendedUrlService;
 
-    public function __construct(array $publicPaths = [], ?IntendedUrlService $intendedUrlService = null)
+    public function __construct(array $publicPaths, IntendedUrlService $intendedUrlService)
     {
         $normalizedPaths = [];
         foreach ($publicPaths as $path) {
@@ -34,7 +34,7 @@ class AccessControl
         }
 
         $this->configuredPublicPaths = array_values(array_unique($normalizedPaths));
-        $this->intendedUrlService = $intendedUrlService ?? new IntendedUrlService();
+        $this->intendedUrlService = $intendedUrlService;
     }
 
     /**