refactor: integration labels, AdminPostAction, ExposurePolicy key parsing (M9)

Integrations name their own admin group (Integration::label, registry
labels()); ToolsTab no longer hard-codes ids and explains why it re-applies
withGroups. AccessTab and LogTab share AdminPostAction (guard, redirect,
terminate seam). ExposurePolicy parses option keys in one place, has one
isRequired() check and a clear $groups docblock (null vs []).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Integrations/Integration.php

@@ -13,6 +13,9 @@ interface Integration
 {
     public function id(): string;
 
+    /** Translated name of the group in the admin UI, e.g. "Medien". */
+    public function label(): string;
+
     public function isAvailable(): bool;
 
     /** @return list<Ability> */