refactor: enforce layer discipline — move repositories, fix constructor injection

- Move HelpdeskTenantSettingsRepository and HelpdeskTokenRepository from
  Service/ to Repository/ directory (GR-SEC-003: SQL only in repositories)
- Make AccessControl constructor require IntendedUrlService explicitly
  instead of falling back to `new IntendedUrlService()` (GR-TEST-002:
  no service instantiation outside factories)
- Update all imports and tests accordingly

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

modules/helpdesk/lib/Module/Helpdesk/Service/HelpdeskOAuthTokenService.php

@@ -2,6 +2,8 @@
 
 namespace MintyPHP\Module\Helpdesk\Service;
 
+use MintyPHP\Module\Helpdesk\Repository\HelpdeskTokenRepository;
+
 /**
  * OAuth2 client_credentials token service for BC OData access.
  *