## ADDED Requirements

### Requirement: Fingerprint on scans
The tag page SHALL compute a lightweight browser fingerprint (UA, language, timezone, screen, platform hash) and include it with every scan POST and finder-contact POST. The scan SHALL store it in `scans.fingerprint`.

#### Scenario: Scan carries fingerprint
- **WHEN** the tag page scripts a scan POST
- **THEN** the request includes a fingerprint and the scan row stores it

### Requirement: 24-hour per-device alert block
When a scan arrives with a fingerprint that was seen on an earlier scan within the last 24 hours, the system SHALL record the scan but SHALL NOT send an alert.

#### Scenario: Same device within 24 h
- **WHEN** a scan arrives with a fingerprint matching a scan from under 24 h ago
- **THEN** the scan is recorded with `alert_sent = false` and no SMS is sent

#### Scenario: Fresh device
- **WHEN** a scan arrives with a fingerprint not seen in the last 24 h
- **THEN** normal alert rules apply (an alert is sent if the throttle conditions permit)

### Requirement: Contact path coverage
The finder-contact submission SHALL also be subject to the fingerprint block when a fingerprint is provided.

#### Scenario: Contact from a blocked device
- **WHEN** a contact submission carries a fingerprint seen within 24 h
- **THEN** the number is stored but no owner SMS is sent