refactor: integration labels, AdminPostAction, ExposurePolicy key parsing (M9)

Integrations name their own admin group (Integration::label, registry
labels()); ToolsTab no longer hard-codes ids and explains why it re-applies
withGroups. AccessTab and LogTab share AdminPostAction (guard, redirect,
terminate seam). ExposurePolicy parses option keys in one place, has one
isRequired() check and a clear $groups docblock (null vs []).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Admin/LogTab.php

@@ -16,14 +16,11 @@ final class LogTab implements AdminTab
     public const CLEAR_ACTION = 'lit_mcp_clear_log';
     private const RESULTS = ['ok', 'partial'];
 
-    /** @var callable(): void */
-    private $terminate;
+    private AdminPostAction $action;
 
     public function __construct(private ChangeLog $log, private Limits $limits, ?callable $terminate = null)
     {
-        $this->terminate = $terminate ?? static function (): void {
-            exit;
-        };
+        $this->action = new AdminPostAction($terminate);
     }
 
     public function slug(): string
@@ -210,13 +207,9 @@ final class LogTab implements AdminTab
 
     public function handleClear(): void
     {
-        if (! current_user_can('manage_options')) {
-            wp_die(esc_html__('Keine Berechtigung.', 'wp-lit-mcp'), '', ['response' => 403]);
-        }
-
+        $this->action->guard();
         check_admin_referer(self::CLEAR_ACTION);
         $this->log->clear();
-        wp_safe_redirect(SettingsPage::url($this->slug(), ['lit_mcp_notice' => 'cleared']));
-        ($this->terminate)();
+        $this->action->redirect($this->slug(), 'cleared');
     }
 }