docs(openspec): archive fingerprint-token-auth after the production pass

The wizard's a2loft calls now authenticate with the session token and carry no
OTP. Field pass in production: the lookup and both fingerprint saves succeeded
with no OTP, so task 3.2 is done. Merged the fingerprint-wizard and tools-app
deltas into the main specs and archived the change.

openspec/changes/archive/2026-10-06-fingerprint-token-auth/proposal.md

@@ -0,0 +1,45 @@
+# Proposal: fingerprint-token-auth
+
+## Why
+
+The Fingerprint Agent wizard's two a2loft calls — staff lookup and fingerprint
+save — prove the operator with a phone number and an OTP forwarded through
+same-origin proxies. a2loft resolves that phone against the domain being
+addressed, so an operator who holds the OpenFGA `capture_biometric` relation
+but is not a super-user of that domain's uploader list is rejected. The cropper
+already saves with the session's PocketBase token; the wizard's a2loft calls
+should use the same token flow.
+
+## What Changes
+
+- The `/api/:domain/staff/:reference` and
+  `/api/:domain/staff/:reference/fingerprints` proxies send the session's
+  PocketBase token as an `Authorization: Bearer` header instead of forwarding
+  `phone`+`otp` query parameters.
+- The OTP validation is removed from the proxies; the session token is the
+  credential.
+- The wizard's lookup and save steps drop their OTP fields and OTP state.
+- The Fingerprint Agent and tools-app specs, the README, and the Help page are
+  updated.
+- Requires the a2loft `fingerprint-token-auth` change deployed first.
+
+## Capabilities
+
+### New Capabilities
+
+(none)
+
+### Modified Capabilities
+
+- `fingerprint-wizard`: the two-finger enrollment flow and the per-call OTP
+  requirement become token-authenticated.
+- `tools-app`: the a2loft proxies requirement now injects the session token
+  instead of forwarding `phone`+`otp`.
+
+## Impact
+
+- `tools/server.js`: the two a2loft proxy handlers and `validateProxy`.
+- `tools/public/assets/fp/index.html`, `tools/public/assets/fp/app.js`: the OTP
+  fields, state and request parameters removed.
+- `tools/test/server.test.js`: proxy assertions.
+- Documentation: README and the Help page.