- Move HelpdeskTenantSettingsRepository and HelpdeskTokenRepository from Service/ to Repository/ directory (GR-SEC-003: SQL only in repositories) - Make AccessControl constructor require IntendedUrlService explicitly instead of falling back to `new IntendedUrlService()` (GR-TEST-002: no service instantiation outside factories) - Update all imports and tests accordingly Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>