docs(openspec): archive fingerprint-token-auth after the production pass

The wizard's a2loft calls now authenticate with the session token and carry no
OTP. Field pass in production: the lookup and both fingerprint saves succeeded
with no OTP, so task 3.2 is done. Merged the fingerprint-wizard and tools-app
deltas into the main specs and archived the change.

openspec/changes/archive/2026-10-06-fingerprint-token-auth/specs/tools-app/spec.md

@@ -0,0 +1,26 @@
+# Spec Delta: tools-app
+
+## MODIFIED Requirements
+
+### Requirement: a2loft proxies inject operator identity
+The app SHALL proxy staff lookup and fingerprint-save calls to
+`https://apis.a2loft.net` under same-origin API routes. The proxy SHALL
+authenticate the operator with the signed-in session's PocketBase token, sent
+as an `Authorization: Bearer` credential, preserving the a2loft request and
+response shapes. The proxies SHALL require a session; a request without one
+SHALL be rejected without contacting a2loft. The proxies SHALL NOT forward or
+require an OTP.
+
+#### Scenario: Staff lookup via proxy
+- **WHEN** the page requests staff details for a domain and reference
+- **THEN** the app calls a2loft's identity endpoint with the session token as a
+  bearer credential and returns a2loft's response unchanged
+
+#### Scenario: Fingerprint save via proxy
+- **WHEN** the page saves fingerprints for a domain and reference
+- **THEN** the app posts them to a2loft's fingerprint endpoint with the session
+  token as a bearer credential
+
+#### Scenario: Unauthenticated proxy call rejected
+- **WHEN** a proxy route is called without a valid session
+- **THEN** the app rejects the call without contacting a2loft