refactor: enforce layer discipline — move repositories, fix constructor injection

- Move HelpdeskTenantSettingsRepository and HelpdeskTokenRepository from
  Service/ to Repository/ directory (GR-SEC-003: SQL only in repositories)
- Make AccessControl constructor require IntendedUrlService explicitly
  instead of falling back to `new IntendedUrlService()` (GR-TEST-002:
  no service instantiation outside factories)
- Update all imports and tests accordingly

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/Http/AccessControlTest.php

@@ -3,13 +3,19 @@
 namespace MintyPHP\Tests\Http;
 
 use MintyPHP\Http\AccessControl;
+use MintyPHP\Http\IntendedUrlService;
 use PHPUnit\Framework\TestCase;
 
 class AccessControlTest extends TestCase
 {
+    private function createAccessControl(array $publicPaths = []): AccessControl
+    {
+        return new AccessControl($publicPaths, new IntendedUrlService());
+    }
+
     public function testConfiguredPublicPathIsAccessible(): void
     {
-        $accessControl = new AccessControl(['imprint', 'privacy']);
+        $accessControl = $this->createAccessControl(['imprint', 'privacy']);
 
         $this->assertTrue($accessControl->isPublicPath('imprint'));
         $this->assertTrue($accessControl->isPublicPath('/privacy'));
@@ -17,7 +23,7 @@ class AccessControlTest extends TestCase
 
     public function testPageSlugPathIsNotAutoPublic(): void
     {
-        $accessControl = new AccessControl(['imprint']);
+        $accessControl = $this->createAccessControl(['imprint']);
 
         $this->assertTrue($accessControl->isPublicPath('imprint'));
         $this->assertFalse($accessControl->isPublicPath('page/imprint'));
@@ -25,7 +31,7 @@ class AccessControlTest extends TestCase
 
     public function testAlwaysPublicPrefixesRemainAccessible(): void
     {
-        $accessControl = new AccessControl([]);
+        $accessControl = $this->createAccessControl([]);
 
         $this->assertTrue($accessControl->isPublicPath('api/v1/health'));
         $this->assertTrue($accessControl->isPublicPath('auth/microsoft/callback'));