Fleet: per-node dev-tool version cards + nightly latest-check (Phase 1, read-only)

Each node card now shows installed versions of Docker / Claude Code / Kimi / GLM /
Ollama (conditional per node) under the ssh card, with an "update available" badge.

- daemon: probe_tools() finds docker/claude/kimi-cli/ollama across candidate bin dirs,
  extracts semver from --version, reports {"t":"node_tools",...} on connect + every 15m.
- migration node_tools + tool_latest; cm-db repo node_tools (upsert/list/latest).
- cm-api: fleet.rs NodeTools uplink → upsert; tool_versions.rs spawn_latest_checker
  (24h, npm/pypi/github; docker display-only); GET /api/nodes/{id}/tools (glm mirrors
  claude). Spawned in clawmates-server.
- frontend: NodeTools cards on each HostCard with the ↑latest badge.

Phase 2 (one-click update execution) intentionally deferred.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/bins/clawmates-server/src/main.rs

@@ -284,6 +284,8 @@ async fn run() -> Result<(), String> {
     cm_api::beszel::spawn_poller(pool.clone(), std::time::Duration::from_secs(15));
     // Fleet automation: evaluate metric-threshold rules → drain/undrain/alert.
     cm_api::node_rules::spawn_evaluator(pool.clone(), std::time::Duration::from_secs(20));
+    // Nightly: check upstream for newer dev-tool releases (claude/kimi/ollama).
+    cm_api::tool_versions::spawn_latest_checker(pool.clone(), std::time::Duration::from_secs(86_400));
 
     // Hosted identity (Clerk / OIDC): pin the issuer and load its JWKS.
     let auth_verifier = match config.auth.mode {