[vmarkop]

Authorization-code issuance now obtains a Wallet Instance Attestation (WIA) when the authorization server advertises attest_jwt_client_auth. The wallet uses the attestation and its bound key for PAR, token exchange, and token refresh, preserving them across issuance sessions.

• Add attestation-based client authentication with fresh signed proofs and bounded challenge retries alongside DPoP nonce handling.
• Persist WIA in wallet state schema v4, retaining compatibility with existing state and legacy events.
• Bind credential proof JWTs to the first attested credential key, check matching JWK thumbprints, and include the key attestation in the protected header for the WE BUILD KA profile.