refactor: integration labels, AdminPostAction, ExposurePolicy key parsing (M9)

Integrations name their own admin group (Integration::label, registry
labels()); ToolsTab no longer hard-codes ids and explains why it re-applies
withGroups. AccessTab and LogTab share AdminPostAction (guard, redirect,
terminate seam). ExposurePolicy parses option keys in one place, has one
isRequired() check and a clear $groups docblock (null vs []).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Integrations/IntegrationRegistry.php

@@ -67,6 +67,17 @@ final class IntegrationRegistry
         return $map;
     }
 
+    /** @return array<string, string> Integration id => label, of the available integrations. */
+    public function labels(): array
+    {
+        $labels = [];
+        foreach ($this->loaded() as [$integration]) {
+            $labels[$integration->id()] = $integration->label();
+        }
+
+        return $labels;
+    }
+
     /** @return list<string> Ids of all known integrations, available or not. */
     public function ids(): array
     {