Fix #1310: drop dangling applyApiResponse refs in admin groups delete/save

[rumblefrog]

Fixes #1310.

Summary

Three then(function (r) { applyApiResponse(r); }) callbacks in web/themes/default/page_admin_groups_list.tpl referenced a global helper that was deleted along with web/scripts/sourcebans.js at #1123 D1. The server-side groups.remove / groups.edit calls still fired and completed, but the .then(...) callback threw an unhandled ReferenceError before window.SBPP.showToast ever ran — clicking Delete on a group hung the page with a red console error and no UI confirmation that anything happened.

The three call sites:

• SbppGroupsSave (line 401, save / edit path)
• SbppGroupsDelete (line 408, the path the report exercises)
• SbppServerGroupsDelete (line 414, server admin / server group delete)

The fix replaces the three callbacks with the canonical inline response handler already used by the sibling page_admin_groups_add.tpl's SbppGroupsAdd callback:

• success / error toast via window.SBPP.showToast,
• sb.message.* fallback for legacy themes that never wired SBPP,
• honours r.data.reload (set by groups.edit after a save), and
• — for handlers like groups.remove whose envelope only carries message.redir (no data.reload) — navigates to that URL after the toast so the master-detail editor stops pointing at the row that just got deleted.

The handler is factored into a small SbppGroupsApplyResponse helper so all three callers share one definition.

Out of scope

The defensive typeof window.applyApiResponse === 'function' guard in page_admin_bans_email.tpl:123 is a separate dead-code cleanup (it never throws because of the guard, just no-ops a fallback path) and is intentionally left out of scope here, as the issue itself notes.

Docs

No AGENTS.md / ARCHITECTURE.md updates needed per the "Keep the docs in sync" table — this is a pure bug fix that does not change a subsystem, request lifecycle, schema, or convention. The sourcebans.js anti-pattern entry already calls out exactly this class of zombie reference.

Test plan

Local quality gates (mirror CI):

• ./sbpp.sh phpstan — pass (228/228 files, no errors).
• ./sbpp.sh test — pass (403 tests, 1765 assertions; the one PHPUnit deprecation pre-exists this PR).
• ./sbpp.sh ts-check — pass (no .js source changes; the inline JS in .tpl is not in scope of tsc --checkJs).
• ./sbpp.sh e2e --grep "admin groups" --project=chromium --workers=1 — pass:
  • flows/admin-groups-delete.spec.ts (new, this PR) — deletes the seeded group, asserts no pageerror, asserts the success toast surfaces, asserts the row is gone after the redirect.
  • flows/admin-groups-bitmask.spec.ts (Web admin groups bitmask preview goes negative when high-bit flags toggled — JS |= returns Int32 #1272) — still green.
• ./sbpp.sh e2e specs/smoke/admin/groups.spec.ts --project=chromium --workers=1 — pass.

The --workers=1 flag mirrors CI; with the local default of workers > 1, the sibling bitmask spec races itself against the truncate-and-reseed in this spec's beforeEach (the documented workers: 1 constraint in AGENTS.md "Playwright E2E specifics").