refactor: integration labels, AdminPostAction, ExposurePolicy key parsing (M9)

Integrations name their own admin group (Integration::label, registry
labels()); ToolsTab no longer hard-codes ids and explains why it re-applies
withGroups. AccessTab and LogTab share AdminPostAction (guard, redirect,
terminate seam). ExposurePolicy parses option keys in one place, has one
isRequired() check and a clear $groups docblock (null vs []).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Admin/ToolsTab.php

@@ -68,8 +68,12 @@ final class ToolsTab implements AdminTab
 
     public function render(): void
     {
+        // Bind the policy to the groups of exactly the abilities listed below. The plugin's policy
+        // carries a lazy map of the same registry (resolved here anyway); a policy built without
+        // withGroups() would otherwise ignore every group mode and "nur lesen" switch on this page.
         $policy = $this->policy->withGroups($this->registry->groupMap());
         $groups = $this->registry->grouped();
+        $labels = $this->registry->labels();
 
         $this->renderIntro(isset($groups['divi']));
         $this->renderCounter(count($policy->directNames($this->registry->abilities())));
@@ -84,7 +88,7 @@ final class ToolsTab implements AdminTab
         echo '<div class="lit-mcp-groups">';
         $closed = $this->savedClosedBoxes();
         foreach ($groups as $group => $abilities) {
-            $this->renderGroup($policy, $group, $abilities, $closed);
+            $this->renderGroup($policy, $group, $labels[$group] ?? $group, $abilities, $closed);
         }
         echo '</div>';
         submit_button();
@@ -158,10 +162,14 @@ final class ToolsTab implements AdminTab
      * @param list<Ability>     $abilities
      * @param list<string>|null $closedBoxes
      */
-    private function renderGroup(ExposurePolicy $policy, string $group, array $abilities, ?array $closedBoxes): void
-    {
+    private function renderGroup(
+        ExposurePolicy $policy,
+        string $group,
+        string $label,
+        array $abilities,
+        ?array $closedBoxes
+    ): void {
         $count = count($abilities);
-        $label = $this->groupLabel($group);
         $boxId = 'lit-mcp-group-' . self::idPart($group);
         $modes = [ExposurePolicy::DIRECT => 0, ExposurePolicy::INDIRECT => 0, ExposurePolicy::DISABLED => 0];
         $mixed = false;
@@ -374,18 +382,6 @@ final class ToolsTab implements AdminTab
         return trim((string) preg_replace('/[^a-z0-9]+/', '-', strtolower($value)), '-');
     }
 
-    private function groupLabel(string $group): string
-    {
-        return match ($group) {
-            'core' => __('Grundlagen', 'wp-lit-mcp'),
-            'wordpress' => __('WordPress', 'wp-lit-mcp'),
-            'media' => __('Medien', 'wp-lit-mcp'),
-            'pods' => __('Pods', 'wp-lit-mcp'),
-            'divi' => __('Divi', 'wp-lit-mcp'),
-            default => $group,
-        };
-    }
-
     private function modeLabel(string $mode): string
     {
         return match ($mode) {