Trim test suite

The suite has grown to 153 tests, 57 of them functional methods that each pay for a full site install. Locally that is about 107 seconds with 90% spent in the functional layer; on GitLab CI it is correspondingly expensive. A fair amount of that functional coverage re-proves logic that the kernel and unit layers already own: RestrictionHookTest drives isLoginAllowed() directly, RoleFirewallTest covers the role OR-logic, and RoleRestrictionTest covers role removal and the permissions hash.

Proposed trims, keeping end-to-end smoke coverage for every user-facing flow:

• Move the LoginTest global/user allow-deny matrix (10 methods) to a kernel data provider, keeping two functional smoke tests (allowed login, denied login with inline error).
• Merge each settings form's validation + submit tests into single methods (UiTest 20 to about 9): one install can assert both the rejection and the round-trip.
• Consolidate RoleTest display and enforcement overlap, move the role-delete config cleanup to kernel, and merge the end-session scenarios where they share a site.
• Merge the two-method classes (HelpTest, IpRangeListTest, RoleEditFormTest, RedirectTest partially) into single-install scenario methods.
• Cut the per-test setup cost: the functional base class currently creates and logs in an admin just to scrape the client IP from a settings page; an anonymous route in the existing test module can return it in one request.

Expected result is roughly half the functional methods (57 to about 31) and half the CI time, with the logic matrix moving to kernel tests rather than disappearing. A detailed per-test keep/move/merge/delete plan is attached to the MR.