refactor: integration labels, AdminPostAction, ExposurePolicy key parsing (M9)

Integrations name their own admin group (Integration::label, registry
labels()); ToolsTab no longer hard-codes ids and explains why it re-applies
withGroups. AccessTab and LogTab share AdminPostAction (guard, redirect,
terminate seam). ExposurePolicy parses option keys in one place, has one
isRequired() check and a clear $groups docblock (null vs []).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Admin/ToolsTabTest.php

@@ -30,6 +30,9 @@ final class ToolsTabTest extends TestCase
         }
         $integration = Mockery::mock(Integration::class);
         $integration->allows('id')->andReturn($id);
+        $integration->allows('label')->andReturn(
+            ['core' => 'Grundlagen', 'media' => 'Medien', 'divi' => 'Divi', 'wordpress' => 'WordPress'][$id] ?? $id
+        );
         $integration->allows('isAvailable')->andReturn($available);
         $integration->allows('abilities')->andReturn($mocks);