feat(helpdesk): refactor multi-tenant BC settings and risk radar improvements

Restructure helpdesk tenant settings into per-connection config with
improved token handling. Update risk radar data endpoint and UI.
Clean up ImageUploadTrait and update architecture contract tests.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

modules/helpdesk/lib/Module/Helpdesk/Service/HelpdeskTenantSettingsRepository.php

@@ -89,39 +89,60 @@ class HelpdeskTenantSettingsRepository
     }
 
     /**
+     * Update only the columns present in $data — leaves other columns untouched.
+     * This prevents overwriting secrets (basic_password_enc, oauth_client_secret_enc)
+     * when they are not explicitly included in the save payload.
+     *
      * @param array<string, mixed> $data
      */
     private function update(int $tenantId, array $data): bool
     {
-        $row = $this->buildRow($data);
+        $allowed = self::allowedColumns();
+        $setClauses = [];
+        $params = [];
+
+        foreach ($allowed as $col) {
+            if (!array_key_exists($col, $data)) {
+                continue;
+            }
+            $setClauses[] = "{$col} = ?";
+            $params[] = (string) ($data[$col] ?? '');
+        }
+
+        if ($setClauses === []) {
+            return true;
+        }
+
+        $params[] = (string) $tenantId;
 
         return (bool) DB::update(
-            'UPDATE helpdesk_tenant_settings SET override_enabled = ?, auth_mode = ?, odata_base_url = ?, company_name = ?, basic_user = ?, basic_password_enc = ?, oauth_tenant_id = ?, oauth_client_id = ?, oauth_client_secret_enc = ?, oauth_token_endpoint = ?, system_recommendations_config = ?, controlling_risk_config = ? WHERE tenant_id = ?',
-            $row['override_enabled'],
-            $row['auth_mode'],
-            $row['odata_base_url'],
-            $row['company_name'],
-            $row['basic_user'],
-            $row['basic_password_enc'],
-            $row['oauth_tenant_id'],
-            $row['oauth_client_id'],
-            $row['oauth_client_secret_enc'],
-            $row['oauth_token_endpoint'],
-            $row['system_recommendations_config'],
-            $row['controlling_risk_config'],
-            (string) $tenantId
+            'UPDATE helpdesk_tenant_settings SET ' . implode(', ', $setClauses) . ' WHERE tenant_id = ?',
+            ...$params
         );
     }
 
     /**
-     * Build a complete row array from partial data, using empty strings as defaults.
+     * Build a complete row for INSERT, using empty strings for missing columns.
      *
      * @param array<string, mixed> $data
      * @return array<string, string>
      */
     private function buildRow(array $data): array
     {
-        $columns = [
+        $row = [];
+        foreach (self::allowedColumns() as $col) {
+            $row[$col] = (string) ($data[$col] ?? '');
+        }
+
+        return $row;
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private static function allowedColumns(): array
+    {
+        return [
             'override_enabled',
             'auth_mode',
             'odata_base_url',
@@ -135,12 +156,5 @@ class HelpdeskTenantSettingsRepository
             'system_recommendations_config',
             'controlling_risk_config',
         ];
-
-        $row = [];
-        foreach ($columns as $col) {
-            $row[$col] = (string) ($data[$col] ?? '');
-        }
-
-        return $row;
     }
 }