feat(helpdesk): align module with core list/drawer standards

- add helpdesk module pages, services, settings and tests

- standardize debtor list on drawer/grid contracts and robust filter drawer behavior

- add helpdesk aside panel navigation and settings visibility provider

- switch primary list slug to helpdesk/debitor and remove helpdesk/search compatibility

- include required core contract updates for list contracts and detail/drawer integration

db/init/init.sql

@@ -1550,7 +1550,8 @@ JOIN permissions p ON p.`key` IN (
   'api_tokens.manage',
   'mail_log.view', 'api_audit.view', 'system_audit.view', 'system_audit.purge',
   'stats.view', 'system_info.view',
-  'roles.assign_all'
+  'roles.assign_all',
+  'helpdesk.access', 'helpdesk.settings.manage'
 )
 WHERE r.description IN ('Admin', 'Administrator') OR r.id = 1
 ON DUPLICATE KEY UPDATE role_id = role_id;
@@ -1613,7 +1614,8 @@ JOIN permissions p ON p.`key` IN (
   'address_book.view',
   'departments.view', 'roles.view',
   'api_tokens.manage',
-  'custom_fields.edit_values'
+  'custom_fields.edit_values',
+  'helpdesk.access'
 )
 WHERE r.code = 'SUPPORT'
 ON DUPLICATE KEY UPDATE role_id = role_id;

db/updates/2026-04-02-helpdesk-permissions.sql

@@ -0,0 +1,20 @@
+-- Helpdesk module: assign permissions to Admin and Support roles.
+-- Admin gets full access (helpdesk.access + helpdesk.settings.manage).
+-- Support gets helpdesk.access only.
+-- Idempotent: safe to run multiple times.
+
+-- Admin: full helpdesk access
+INSERT INTO `role_permissions` (`role_id`, `permission_id`, `created`)
+SELECT r.id, p.id, NOW()
+FROM roles r
+JOIN permissions p ON p.`key` IN ('helpdesk.access', 'helpdesk.settings.manage')
+WHERE r.description IN ('Admin', 'Administrator') OR r.id = 1
+ON DUPLICATE KEY UPDATE role_id = role_id;
+
+-- Support: helpdesk read access
+INSERT INTO `role_permissions` (`role_id`, `permission_id`, `created`)
+SELECT r.id, p.id, NOW()
+FROM roles r
+JOIN permissions p ON p.`key` = 'helpdesk.access'
+WHERE r.code = 'SUPPORT'
+ON DUPLICATE KEY UPDATE role_id = role_id;