At the outpatient annex, most client traffic (browsing local file shares, printing to a local printer) stays within the annex itself, and only a small portion needs to reach the main hospital campus. The design wants that local traffic switched right at the AP instead of adding unnecessary load to the point-to-point link back to campus. Which forwarding mode best fits the majority of this traffic?

Bridge mode forwards client traffic locally at the AP directly onto the nearby wired network, without sending it through a tunnel to a remote gateway, which is exactly the behavior wanted here: local file shares and local printing stay local, and the point-to-point link back to the main campus is not burdened with traffic that never needed to leave the annex. Tunnel mode for everything would send even purely local traffic — file shares, print jobs — across the point-to-point link and back, adding unnecessary load exactly where the design wants to avoid it. Mesh mode is unrelated to this decision; it describes how APs relay frames to each other wirelessly when there's no wired uplink, not how traffic is forwarded once it reaches a wired AP with local resources available. Describing split-tunnel as 'tunnel everything and bridge nothing' isn't split-tunnel at all — that configuration is just full tunnel mode wearing a different label, and it fails the requirement for the same reason full tunnel does. A caveat: bridge mode means the annex needs its own local resources (like the printer and file share) actually present on its own network — if those services later move to the main campus, the forwarding decision would need to be revisited. Operational check: confirm print jobs and file-share traffic complete without any visible round trip delay associated with the point-to-point link.