feat(fpagent): authenticate the wizard's a2loft calls with the session token

The fingerprint wizard's staff-lookup and fingerprint-save proxies forwarded the page's OTP with the session phone. a2loft resolves that phone against the domain being addressed, so an operator who holds only capture_biometric was rejected unless they were a domain super-user. The cropper already saves with the session token.

- tools/server.js: both a2loft proxies send Authorization: Bearer <session token>, no phone/otp; validateProxy drops the OTP and phone checks.
- tools/public/assets/fp: both OTP fields, otpLookup/otpSave state, request params and resets removed; canLookup/canSave no longer gate on OTP.
- Tests assert the Bearer header, no query auth, no OTP field in the served page, and both gates without a credential (66/66 pass).
- README and Help page updated.

Requires the a2loft fingerprint-token-auth change deployed first. OpenSpec change: fingerprint-token-auth.

tools/test/fp-wizard.test.js

@@ -129,6 +129,16 @@ test('capture is refused when no reader is attached', () => {
   assert.equal(vmInst.notif.show, true);
 });
 
+test('lookup and save need no OTP credential', () => {
+  const vmInst = makeVm(loadApp());
+  vmInst.domain = 'uc';
+  vmInst.reference = 'UC/1';
+  assert.equal(vmInst.canLookup, true);
+  vmInst.fingers['right-thumb'].status = 'done';
+  vmInst.fingers['right-index-finger'].status = 'done';
+  assert.equal(vmInst.canSave, true);
+});
+
 test('disconnect clears availability', () => {
   const app = loadApp();
   const vmInst = makeVm(app);