OXDEV-9078 Add todos

Author: Sieg

src/Authentication/TwoFactorAuth/Service/TwoFAUserService.php

@@ -15,6 +15,9 @@
 use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Infrastructure\Factory\UserModelFactoryInterface;
 use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Settings\TwoFASettingsInterface;
 
+/**
+ * todo-high: challenge the idea - session part should go to the separate login state service
+ */
 class TwoFAUserService implements TwoFAUserServiceInterface
 {
     public const USER_SESSION_KEY = 'pending_authorized_user';
@@ -45,6 +48,7 @@ public function loginUser(string $userId): void
     {
         $this->session->remove(self::USER_SESSION_KEY);
 
+        // todo-high: looks like it can go to the infrastructure layer
         $user = $this->userFactory->create();
         $user->load($userId);