[OID4VCI] tx_code (transaction PIN) second factor is non-functional — field never assigned

Description

CredentialOfferState.txCode is declared and read via getTxCode() (lines 101-103) but is never assigned — there is no setter, no constructor argument, and no Jackson deserialization source. In PreAuthorizedCodeGrantType at lines 124-137, expTxCode is always null, so the PIN validation branch is unreachable. The tx_code second factor advertised in metadata is completely non-functional.

Related: #49787 addresses the ordering issue where the pre-authorized code is consumed before tx_code validation. That fix is necessary but insufficient — even with correct ordering, the txCode field is never populated, making the entire validation branch dead code. This issue addresses the root cause.

Version affected

999.0.0-SNAPSHOT (development main)

Expected behavior

When tx_code is configured for a credential offer, the txCode value should be generated, stored in CredentialOfferState, and validated during the pre-authorized code grant flow.

Actual behavior

At CredentialOfferState.java:41, txCode is declared but never assigned anywhere in the codebase (grep 'setTxCode|.txCode\s*=' → no hits outside model POJOs). At PreAuthorizedCodeGrantType.java:124-137, if (expTxCode != null) is always false.

Steps to reproduce

1. Search for setTxCode or .txCode = in the codebase — no assignment exists
2. Review CredentialOfferState.java:41 — field declared, getTxCode() at lines 101-103
3. Review PreAuthorizedCodeGrantType.java:124-137 — expTxCode always null, PIN check unreachable