task: #3614487 Trim the test suite to cut CI time

Halves the functional test surface without dropping coverage: functional methods go from 59 to 26, and the full suite runs in 58s locally instead of 107s. Every deletion has a named owner at a cheaper layer, and every user-facing flow keeps an end-to-end test.

What moved where:

• The LoginTest global/user allow-deny matrix (10 methods) is now a kernel data provider (LoginFirewallTest::testIsLoginAllowedMatrix, 11 cases) driving isLoginAllowed() directly. Two functional smoke tests remain: a successful login and a denied login with the inline error.
• The user-delete field cleanup and the role-delete config cleanup moved to kernel tests (LoginFirewallTest::testUserDelete, RoleDeleteTest); both are entity API behavior with no browser dependency.
• Each settings form's validation and submission tests merged into single-install methods (UiTest 20 to 9): one install asserts both the rejection and the round-trip.
• RoleTest's display trio was removed; the role OR-logic is unit-tested (RoleFirewallTest), role removal is kernel-tested (RoleRestrictionTest), and the merged permission-enforcement method still proves the effect through real page access (403 out of range, 200 in range). testUiRoleRenamed was removed: the config is keyed by role id, so a label rename cannot affect it.
• The two-method classes (HelpTest, IpRangeListTest, RoleEditFormTest) and RedirectTest's two bounce scenarios merged into single-install scenario methods.
• The functional base class no longer creates and signs in an admin to scrape the client IP from a settings page. The test-support module gains an anonymous route returning only the resolved client IP as plain text; setUp() is now one unauthenticated request. The route lives in the hidden test module, which is undiscoverable on real sites.

phpcs, phpstan level 6 and cspell clean; the trimmed suite is 133 tests, 551 assertions, zero failures.

Implementation was AI-assisted; reviewed assertion-by-assertion by hand.