docs(openspec): archive fingerprint-token-auth after the production pass

The wizard's a2loft calls now authenticate with the session token and carry no
OTP. Field pass in production: the lookup and both fingerprint saves succeeded
with no OTP, so task 3.2 is done. Merged the fingerprint-wizard and tools-app
deltas into the main specs and archived the change.

openspec/changes/archive/2026-10-06-fingerprint-token-auth/tasks.md

@@ -25,5 +25,6 @@
 
 - [x] 3.1 Run the full tools test suite (`node --test`) and confirm it passes.
   (66/66 pass.)
-- [ ] 3.2 Field pass against a real domain (a2loft deployed): look up a
-  reference and save both fingerprints with no OTP.
+- [x] 3.2 Field pass against a real domain (a2loft deployed): look up a
+  reference and save both fingerprints with no OTP. Verified in production:
+  the lookup and both fingerprint saves succeeded with no OTP.