feat(fpagent): authenticate the wizard's a2loft calls with the session token

The fingerprint wizard's staff-lookup and fingerprint-save proxies forwarded the page's OTP with the session phone. a2loft resolves that phone against the domain being addressed, so an operator who holds only capture_biometric was rejected unless they were a domain super-user. The cropper already saves with the session token.

- tools/server.js: both a2loft proxies send Authorization: Bearer <session token>, no phone/otp; validateProxy drops the OTP and phone checks.
- tools/public/assets/fp: both OTP fields, otpLookup/otpSave state, request params and resets removed; canLookup/canSave no longer gate on OTP.
- Tests assert the Bearer header, no query auth, no OTP field in the served page, and both gates without a credential (66/66 pass).
- README and Help page updated.

Requires the a2loft fingerprint-token-auth change deployed first. OpenSpec change: fingerprint-token-auth.

openspec/changes/fingerprint-token-auth/tasks.md

@@ -0,0 +1,29 @@
+# Tasks
+
+## 1. Proxies
+
+- [x] 1.1 `tools/server.js`: `a2loftUrl`/`a2loftSaveUrl` drop `phone`/`otp`;
+  both handlers send `Authorization: Bearer ${req.session.token}`;
+  `validateProxy` drops the OTP/phone checks and keeps domain + reference.
+  Verified: the proxy tests assert the Bearer header and no query auth.
+- [x] 1.2 Update the proxy tests: assert no `?otp`, assert the Bearer header,
+  and drop the no-OTP rejection case while the auth/domain rejection remains
+  (no a2loft call). Verified.
+
+## 2. Wizard UI
+
+- [x] 2.1 `tools/public/assets/fp/index.html`: remove the lookup and save OTP
+  inputs.
+- [x] 2.2 `tools/public/assets/fp/app.js`: remove `otpLookup`/`otpSave`, the
+  `otp` request params, and the OTP resets; tighten `canLookup`/`canSave`.
+  Verified: the served page has no OTP field (server test) and both gates pass
+  without a credential (wizard test).
+- [x] 2.3 Update the `fingerprint-wizard` and `tools-app` spec deltas, README
+  steps 1/3, the a2loft proxy paragraph, and the Help page.
+
+## 3. Verify
+
+- [x] 3.1 Run the full tools test suite (`node --test`) and confirm it passes.
+  (66/66 pass.)
+- [ ] 3.2 Field pass against a real domain (a2loft deployed): look up a
+  reference and save both fingerprints with no OTP.