feat: Add storage management for VM creation and resizing

- Introduced storage parameter in VmCreateRequest and VmResizeRequest models.
- Implemented storage validation to ensure minimum and maximum limits.
- Enhanced CLI to support storage options during VM creation and resizing.
- Updated lifecycle management to handle pending resize operations for VM resources.
- Added methods for resizing VM disks and validating storage capacity.
- Updated API endpoints to accommodate new storage functionality.
- Refactored related validation and configuration logic to support storage management.

DEVELOPER.md

@@ -49,7 +49,7 @@ Requirements for real host operations:
 - Root privileges for installation and lifecycle mutations
 - `iproute2`, `iptables`, `nftables`, `conntrack`, `e2fsprogs`, `util-linux`,
   `openssl`, and OpenSSH client tools
-- An x86_64 host for the default kernel/rootfs URLs
+- An x86_64 or ARM64 (`aarch64`) host, including NVIDIA DGX Spark
 
 Do not run real integration operations on a developer workstation unless the
 bridge, subnet, firewall changes, and guest workload are acceptable there.
@@ -432,6 +432,8 @@ The `firecracker/` package has three separate responsibilities.
 
 The guest receives a static IP via the kernel `ip=` boot argument. The netmask
 comes from `Settings.network`, not a hard-coded `/24` value.
+ARM64 guests also receive `keep_bootcon`, as recommended by Firecracker's
+getting-started guide; both architectures use `console=ttyS0`.
 
 ### Process Safety
 
@@ -563,6 +565,9 @@ exclusive create for its replacement. Foreign ownership is an error, not an
 adoption opportunity. Readback normalizes presentation differences but compares
 all effective objects, ordered rules, hooks, identity, and the full port set;
 rule counts or an owner comment alone are not proof of enforcement.
+Normalization materializes implied EtherType constraints before folding
+transport-protocol dependencies. This accepts nftables' omitted redundant
+`ether type ip` checks while retaining the IPv4 scope of TCP rules.
 
 The policy has prerouting/input/forward/output hooks. Early prerouting identity
 checks run at priority -310, before conntrack and bridge MAC learning; input
@@ -590,6 +595,8 @@ of conntrack entries scoped to the guest IP in all four original/reply source
 and destination fields, including NAT reply tuples. Only then may teardown
 release the address. Rule removal also requires an absent TAP and verified
 table ownership; it never flushes global firewall or conntrack state.
+Cleanup uses conntrack's documented `-D` (delete) and `-L` (list) commands,
+including on conntrack-tools 1.4.8, where `--list` is not a supported option.
 
 ### Coexistence and Recovery
 
@@ -612,6 +619,15 @@ do not import its unimplemented topology checks into current documentation.
 `Installer` is the only owner of apt installation, Firecracker artifact
 handling, downloads, and integrity-manifest publication.
 
+`Settings` detects and normalizes the host architecture at construction time
+(`amd64` to `x86_64`, `arm64` to `aarch64`) and rejects unsupported architectures.
+The same architecture selects the Firecracker release archive, guest kernel,
+rootfs, and architecture-specific boot arguments. Default guest URLs use
+Firecracker's `img/quickstart_guide/<architecture>/` assets: `kernels/vmlinux.bin`
+and `rootfs/bionic.rootfs.ext4`. Kernel and rootfs URL overrides are independent;
+custom assets and trusted digests must match the host architecture. ARM64
+uses an uncompressed Linux `Image` (PE format) and an ARM64 ext4 rootfs.
+
 The host package list includes `nftables` and `conntrack` as well as the
 existing iproute2/iptables, ext4, OpenSSL, OpenSSH, download, and util-linux
 tools. UVM adds no reconciliation daemon or tested external firewall-manager
@@ -788,6 +804,10 @@ prove the kernel's actual packet behavior.
 
 FastAPI route tests are conditionally enabled when both `fastapi` and `httpx`
 are installed. They should be enabled in CI using the `test` extra.
+When `nft` and `conntrack` are installed, command-parser tests append an invalid
+final command/option so parsing is checked without executing any mutation.
+These checks supplement fixture-based readback and cleanup tests; they do not
+exercise the kernel packet path.
 
 ### Isolated Packet Tests