refactor: integration labels, AdminPostAction, ExposurePolicy key parsing (M9)

Integrations name their own admin group (Integration::label, registry
labels()); ToolsTab no longer hard-codes ids and explains why it re-applies
withGroups. AccessTab and LogTab share AdminPostAction (guard, redirect,
terminate seam). ExposurePolicy parses option keys in one place, has one
isRequired() check and a clear $groups docblock (null vs []).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Admin/AccessTab.php

@@ -15,17 +15,14 @@ final class AccessTab implements AdminTab
     public const GROUP = 'lit_mcp_access';
     public const REVOKE_ACTION = 'lit_mcp_revoke';
 
-    /** @var callable(): void */
-    private $terminate;
+    private AdminPostAction $action;
 
     public function __construct(
         private Access $access,
         private ConnectionRepository $connections,
         ?callable $terminate = null
     ) {
-        $this->terminate = $terminate ?? static function (): void {
-            exit;
-        };
+        $this->action = new AdminPostAction($terminate);
     }
 
     public function slug(): string
@@ -121,9 +118,7 @@ final class AccessTab implements AdminTab
 
     public function handleRevoke(): void
     {
-        if (! current_user_can('manage_options')) {
-            wp_die(esc_html__('Keine Berechtigung.', 'wp-lit-mcp'), '', ['response' => 403]);
-        }
+        $this->action->guard();
 
         // phpcs:disable WordPress.Security.NonceVerification.Missing -- verified right below.
         $uuid = isset($_POST['uuid']) && is_string($_POST['uuid'])
@@ -134,9 +129,7 @@ final class AccessTab implements AdminTab
         check_admin_referer(self::REVOKE_ACTION . '_' . $uuid);
 
         $revoked = $this->connections->revoke($userId, $uuid);
-        $notice = $revoked ? 'revoked' : 'revoke_failed';
-        wp_safe_redirect(SettingsPage::url($this->slug(), ['lit_mcp_notice' => $notice]));
-        ($this->terminate)();
+        $this->action->redirect($this->slug(), $revoked ? 'revoked' : 'revoke_failed');
     }
 
     private static function warnOnce(string $code, string $message): void