feat: per-agent tools toggle and better python scratchpad

Add ToolSelector for enabling sandboxed python per agent, drop unsafe
filesystem/bash tools, bundle fetchUrl with web search, and return
Monty's last expression value so agents need not print.

app/components/ChatInput.vue

@@ -50,6 +50,10 @@ const searchConfig = ref({
     rerank: props.agent?.config?.search?.rerank ?? false,
 });
 
+const toolsConfig = ref({
+    python: props.agent?.config?.tools?.python ?? false,
+});
+
 watch(() => props.agent?.config?.search, (val) => {
     searchConfig.value = {
         enabled: val?.enabled ?? false,
@@ -58,21 +62,45 @@ watch(() => props.agent?.config?.search, (val) => {
     };
 }, { deep: true });
 
-const saveSearchConfig = async () => {
+watch(() => props.agent?.config?.tools, (val) => {
+    toolsConfig.value = {
+        python: val?.python ?? false,
+    };
+}, { deep: true });
+
+const saveAgentConfig = async (partial: {
+    search?: typeof searchConfig.value;
+    tools?: typeof toolsConfig.value;
+}) => {
     if (!props.agent) return;
     const currentConfig = props.agent.config ?? {};
     const newConfig = {
         ...currentConfig,
-        search: {
-            enabled: searchConfig.value.enabled,
-            maxResults: searchConfig.value.maxResults,
-            rerank: searchConfig.value.rerank,
-        },
+        ...(partial.search !== undefined ? {
+            search: {
+                enabled: partial.search.enabled,
+                maxResults: partial.search.maxResults,
+                rerank: partial.search.rerank,
+            },
+        } : {}),
+        ...(partial.tools !== undefined ? {
+            tools: {
+                python: partial.tools.python,
+            },
+        } : {}),
     };
     patchAgentLocally(props.agent.id, { config: newConfig });
     updateAgent(props.agent.id, { config: newConfig });
 };
 
+const saveSearchConfig = async () => {
+    await saveAgentConfig({ search: searchConfig.value });
+};
+
+const saveToolsConfig = async () => {
+    await saveAgentConfig({ tools: toolsConfig.value });
+};
+
 const isUploading = computed(() => files.value.some((f) => f.status === 'uploading'));
 const hasFailedUploads = computed(() => files.value.some((f) => f.status === 'error'));
 
@@ -386,6 +414,8 @@ onUnmounted(() => {
                         @update:enabled="(v: boolean) => { searchConfig.enabled = v; saveSearchConfig() }"
                         @update:max-results="(v: number) => { searchConfig.maxResults = v; saveSearchConfig() }"
                         @update:rerank="(v: boolean) => { searchConfig.rerank = v; saveSearchConfig() }" />
+                    <ToolSelector v-if="selectedModel?.capabilities.includes('tools')" :python="toolsConfig.python"
+                        @update:python="(v: boolean) => { toolsConfig.python = v; saveToolsConfig() }" />
                     <FileSelector ref="fileSelectorRef" :selected-model="selectedModel" v-model="files" />
                 </div>
                 <div v-if="allowManualRole" class="flex items-center">