feat(helpdesk): align module with core list/drawer standards

- add helpdesk module pages, services, settings and tests

- standardize debtor list on drawer/grid contracts and robust filter drawer behavior

- add helpdesk aside panel navigation and settings visibility provider

- switch primary list slug to helpdesk/debitor and remove helpdesk/search compatibility

- include required core contract updates for list contracts and detail/drawer integration

modules/helpdesk/lib/Module/Helpdesk/Service/HelpdeskTokenRepository.php

@@ -0,0 +1,79 @@
+<?php
+
+namespace MintyPHP\Module\Helpdesk\Service;
+
+use MintyPHP\DB;
+use MintyPHP\Service\Settings\SettingsCryptoGatewayInterface;
+
+/**
+ * Repository for OAuth2 token cache (helpdesk_oauth_token_cache table).
+ *
+ * All tokens are stored encrypted and tenant-scoped.
+ * This is part of the OAuth2 skeleton for V1.
+ */
+class HelpdeskTokenRepository
+{
+    public function __construct(
+        private readonly SettingsCryptoGatewayInterface $settingsCryptoGateway
+    ) {
+    }
+
+    /**
+     * Find a valid (non-expired) cached token for the given tenant.
+     */
+    public function findValidToken(int $tenantId): ?string
+    {
+        if ($tenantId <= 0) {
+            return null;
+        }
+
+        $result = DB::selectOne(
+            'SELECT access_token_encrypted FROM helpdesk_oauth_token_cache WHERE tenant_id = ? AND expires_at > NOW() ORDER BY created_at DESC LIMIT 1',
+            (string) $tenantId
+        );
+
+        if (!is_array($result) || !isset($result['access_token_encrypted'])) {
+            return null;
+        }
+
+        $encrypted = trim((string) $result['access_token_encrypted']);
+        if ($encrypted === '') {
+            return null;
+        }
+
+        try {
+            return $this->settingsCryptoGateway->decryptString($encrypted);
+        } catch (\Throwable) {
+            return null;
+        }
+    }
+
+    /**
+     * Store a new token in the cache (encrypted, tenant-scoped).
+     */
+    public function storeToken(int $tenantId, string $accessToken, \DateTimeInterface $expiresAt): bool
+    {
+        if ($tenantId <= 0 || $accessToken === '') {
+            return false;
+        }
+
+        try {
+            $encrypted = $this->settingsCryptoGateway->encryptString($accessToken);
+        } catch (\Throwable) {
+            return false;
+        }
+
+        // Remove existing tokens for this tenant first
+        DB::delete(
+            'DELETE FROM helpdesk_oauth_token_cache WHERE tenant_id = ?',
+            (string) $tenantId
+        );
+
+        return (bool) DB::insert(
+            'INSERT INTO helpdesk_oauth_token_cache (tenant_id, access_token_encrypted, expires_at) VALUES (?, ?, ?)',
+            (string) $tenantId,
+            $encrypted,
+            $expiresAt->format('Y-m-d H:i:s')
+        );
+    }
+}