This looks good - please submit pull request.
For the next step, we need to include (somehow) a parameter indicating the repository. That's because there could be multiple apps with the same symbolic name, offered by different repositories. This would likely happen most often during development. For example, a developer could be working on a new ProtAnnot bundle and with the local "target" (build) directory serving as a local repository. Also, the production App Store will also be (or have) a repository, so it will always be able to provide this information to IGB when using the REST endpoint to trigger App installation or update.
After that, I'd like to move WebAppManager into the Plugin Manager module and expose its functionality as a service, along the lines we discussed in the meeting today, rather than give the appstore bundle direct access to the internals of the other bundle. I am not sure how to do it, however, or if this is a good idea or not.