refactor: integration labels, AdminPostAction, ExposurePolicy key parsing (M9)

Integrations name their own admin group (Integration::label, registry
labels()); ToolsTab no longer hard-codes ids and explains why it re-applies
withGroups. AccessTab and LogTab share AdminPostAction (guard, redirect,
terminate seam). ExposurePolicy parses option keys in one place, has one
isRequired() check and a clear $groups docblock (null vs []).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Admin/ToolsTabTest.php

@@ -30,6 +30,9 @@ final class ToolsTabTest extends TestCase
         }
         $integration = Mockery::mock(Integration::class);
         $integration->allows('id')->andReturn($id);
+        $integration->allows('label')->andReturn(
+            ['core' => 'Grundlagen', 'media' => 'Medien', 'divi' => 'Divi', 'wordpress' => 'WordPress'][$id] ?? $id
+        );
         $integration->allows('isAvailable')->andReturn($available);
         $integration->allows('abilities')->andReturn($mocks);
 

tests/Unit/Integrations/IntegrationRegistryTest.php

@@ -4,9 +4,17 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Tests\Unit\Integrations;
 
+use Brain\Monkey\Functions;
 use LIT\MCP\Abilities\Ability;
+use LIT\MCP\Integrations\Core\CoreIntegration;
+use LIT\MCP\Integrations\Divi\DiviIntegration;
 use LIT\MCP\Integrations\Integration;
 use LIT\MCP\Integrations\IntegrationRegistry;
+use LIT\MCP\Integrations\Media\MediaIntegration;
+use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
+use LIT\MCP\Integrations\WordPress\WordPressIntegration;
+use LIT\MCP\Limits;
+use LIT\MCP\Tests\Support\FakeChangeLog;
 use LIT\MCP\Tests\Unit\TestCase;
 use Mockery;
 
@@ -49,6 +57,28 @@ final class IntegrationRegistryTest extends TestCase
         self::assertSame(['core', 'divi', 'pods'], $registry->ids());
     }
 
+    public function testLabelsOfTheAvailableIntegrations(): void
+    {
+        $core = $this->integration('core', true, []);
+        $core->allows('label')->andReturn('Grundlagen');
+
+        $registry = new IntegrationRegistry($core, $this->integration('pods', false, []));
+
+        self::assertSame(['core' => 'Grundlagen'], $registry->labels());
+    }
+
+    /** M9: the integrations own their admin labels (formerly hard-coded in ToolsTab). */
+    public function testEveryIntegrationNamesItsGroup(): void
+    {
+        Functions\stubTranslationFunctions();
+        $schema = Mockery::mock(ContentSchema::class);
+
+        self::assertSame('Grundlagen', (new CoreIntegration(''))->label());
+        self::assertSame('WordPress', (new WordPressIntegration($schema, FakeChangeLog::forbidden()))->label());
+        self::assertSame('Medien', (new MediaIntegration($schema, FakeChangeLog::forbidden(), new Limits()))->label());
+        self::assertSame('Divi', (new DiviIntegration($schema, FakeChangeLog::forbidden()))->label());
+    }
+
     private function ability(string $name, bool $direct): Ability
     {
         $ability = Mockery::mock(Ability::class);