feat(helpdesk): add multi-tenant BC connection settings with risk radar refinements

Introduce per-tenant override for helpdesk BC connection config.
New table helpdesk_tenant_settings stores tenant-specific credentials
with encrypted secrets (AES-256-GCM). EffectiveHelpdeskSettingsService
resolves global vs tenant config per request. Settings UI extended with
tenant override tab, toggle, and dual editing mode.

All runtime consumers (OData, SOAP, OAuth) read through the new
resolver. Token cache flushed on any config change. Default behavior
unchanged — tenants use global config until override explicitly enabled.

Also includes risk radar UI refinements: Stripe-style card redesign
with accent borders and score pills, removal of redundant KPI tiles
and search, and filtering of zero-score entries.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

modules/helpdesk/i18n/default_de.json

@@ -326,5 +326,15 @@
   "Search customers...": "Kunden suchen...",
   "more than resolved": "mehr als gelöst",
   "SLA breaches": "SLA-Verletzungen",
-  "Oldest ticket": "Ältestes Ticket"
+  "Oldest ticket": "Ältestes Ticket",
+  "Tenant override": "Mandanten-Override",
+  "Configuration source": "Konfigurationsquelle",
+  "Current tenant": "Aktueller Mandant",
+  "Use tenant-specific configuration": "Mandantenspezifische Konfiguration verwenden",
+  "When enabled, this tenant uses its own BC connection instead of the global configuration.": "Wenn aktiviert, nutzt dieser Mandant seine eigene BC-Verbindung anstelle der globalen Konfiguration.",
+  "Tenant connection": "Mandanten-Verbindung",
+  "Tenant authentication": "Mandanten-Authentifizierung",
+  "This tenant inherits the global configuration. Enable the toggle above to use tenant-specific settings.": "Dieser Mandant erbt die globale Konfiguration. Aktivieren Sie den Schalter oben, um mandantenspezifische Einstellungen zu verwenden.",
+  "Tenant settings saved": "Mandanten-Einstellungen gespeichert",
+  "Token endpoint must use HTTPS": "Token-Endpunkt muss HTTPS verwenden"
 }