feat(tools): Enhance guest tools installation and management

- Added new API endpoints for tool catalog and installation management.
- Updated usage documentation to include new tool installation features.
- Implemented asynchronous tool installation with job tracking.
- Introduced integration tests for tool installation in disposable VMs.
- Enhanced dashboard UI to reflect tool installation status and usage instructions.
- Improved error handling and logging for tool installation processes.
- Added support for multiple Python versions and Conda environments.
- Refactored tool management logic to ensure better state handling and job persistence.

README.md

@@ -310,7 +310,7 @@ and `/dashboard` routes belong to the Nest server.
 
 The Nest dashboard includes a fleet overview, searchable machine collection,
 private network and port-policy view, host diagnostics, and machine provisioning.
-Open a machine to manage its lifecycle, launch terminal sessions, edit or sync
+Open a machine to manage its lifecycle, install developer tools, launch terminal sessions, edit or sync
 its port rules, copy its SSH command, or read recent logs. Select machines in the
 collection for bulk operations.
 Use `Ctrl+K` / `⌘K` (or `/`) to find a machine or page. Fleet data refreshes every
@@ -330,7 +330,7 @@ The server exposes these routes:
 | `GET` | `/diagnostics` | Run host readiness checks for the dashboard/system view |
 | `POST` | `/install` | Install or refresh host assets; body: `{ "force": false }` |
 | `GET` | `/vms` | List VM records and observed status |
-| `POST` | `/vms` | Create; supports `cpu`, `ram`, `storage`, `guest_ip`, `username`, `password`, `name`, `ports`, `no_default_ports` |
+| `POST` | `/vms` | Create; supports `cpu`, `ram`, `storage`, `guest_ip`, `username`, `password`, `name`, `ports`, `no_default_ports`, `tools` |
 | `POST` | `/vms/actions` | Run a fixed snapshot of selected or all VM lifecycle actions |
 | `GET` | `/vms/{identifier}` | Inspect by exact ID, name, or guest IP |
 | `POST` | `/vms/{identifier}/start` | Boot a retained private disk |
@@ -342,6 +342,10 @@ The server exposes these routes:
 | `POST` | `/vms/{vm_id}/ports/sync` | Reapply a managed private port policy for an exact VM ID |
 | `POST` | `/vms/{vm_id}/exec` | Execute a command/script inside a running VM over vsock, with optional root privileges |
 | `POST` | `/vms/{vm_id}/agent/install` | Install/upgrade the execution agent on a stopped VM's private disk |
+| `GET` | `/tools` | Guest tool catalog and supported Python versions |
+| `GET` | `/vms/{vm_id}/tools` | Tool inventory and installation history; `refresh=true` probes the running guest |
+| `POST` | `/vms/{vm_id}/tools/install` | Queue selected guest tools; HTTP 202 with a job ID |
+| `GET` | `/vms/{vm_id}/tools/jobs/{job_id}` | Per-tool progress, results, and bounded installation output |
 | `GET` | `/vms/{identifier}/logs` | Read a bounded, non-following tail of a VM log |
 | `GET` | `/vms/{vm_id}/sessions` | List this VM's saved sessions (Nest) |
 | `POST` | `/vms/{vm_id}/sessions` | Launch a guest terminal; body: `{}` or `{"rows":24,"cols":80}` (Nest) |
@@ -365,7 +369,47 @@ Log reads use an optional `tail` query parameter from `0` to `1000`, default
 Bulk requests use an action (`start`, `stop`, `restart`, `delete`, or
 `ports-sync`) plus either `identifiers` or `all_vms: true`; they return a result
 for each fixed target and do not prompt for confirmation. Interactive SSH
-remains CLI-only. The API and dashboard are not background reconcilers.
+remains CLI-only. VM lifecycle changes are explicit; accepted tool installation
+jobs are processed in the background.
+
+### One-click Guest Tools
+
+Choose tools under **New machine → Pick your tools** to install them automatically
+after boot. For an existing VM, open **Machines → select a VM → Tools** and click
+**Install**, or select several tools and click **Install selected**. A stopped VM
+offers **Start & install**. Installation works over vsock with SSH disabled.
+
+The initial catalog targets Ubuntu 22.04 guests on x86_64 and ARM64:
+
+| Tool | Default |
+|---|---|
+| Git, wget, curl, htop | Ubuntu packages |
+| Node.js | 24 LTS (24.21.0), including npm and npx |
+| Python | 3.11, 3.12, and 3.13 with pip and venv; versions can coexist |
+| JDK | OpenJDK 21 LTS, including `java` and `javac` |
+| PHP | 8.5 CLI from the signed Ondřej Surý PHP PPA |
+| Conda | Miniforge 26.5.3-0, using conda-forge |
+| micromamba | 2.9.0 |
+
+Node, Python, Miniforge, and micromamba downloads use pinned release checksums.
+Python uses Astral's standalone distributions, exposed as `python3.11`,
+`python3.12`, and `python3.13`. The guest's OS Python continues serving the agent.
+Downloaded tools live under `/opt/uvm-tools`, with executable links in
+`/usr/local/bin`. Conda environments and caches are writable by the configured
+guest user. **Get started** shows commands, including shell initialization for
+Conda/micromamba activation in Nest's non-login terminals.
+
+Jobs run independently of the browser and show progress and captured output per
+tool. Already available tools are verified and skipped. A failed tool can be
+retried on the created VM. Guest internet access is required for downloads.
+Restart the management server to load the feature; older running VMs may need
+**Restart & install** to apply the current guest-agent setup.
+
+The most recent ten jobs and cached inventory are stored in the VM's private
+`tools.json` file. Queued requests resume when the server starts. An interrupted
+in-flight installation has an uncertain outcome and may finish inside the guest;
+use **Check installed tools** before retrying. See
+[API examples and recovery](USAGE.md#install-guest-tools) for details.
 
 ### MicroVM Terminal Sessions