completeDeviceAuthenticationRotation

Submits the pending rotation and, once the server replaced the registered key, makes the pending key K2 the active device authentication key (docs/device-authentication-rotation.md). From then on every request is signed with K2; K1 no longer works.

Reads the current authentication epoch from the server with a request signed by K1, then sends the rotation statement for (K1, epoch) → K2, signed by K1 (authorization) and K2 (proof of possession), with the current time and a fresh nonce.

Safe to call again after a failure, a lost response or a crash before the local promotion: if the server rejects K1 or the rotation as conflicting, expired or replayed, this asks the server whether K2 is registered already (resolveDeviceAuthenticationRotation) before failing. Other failures leave both keys as they are for another attempt. Throws SecureMessageClientException.NoPendingDeviceAuthenticationRotation, SecureMessageTransportException.AuthenticationFailed and SecureMessageTransportException.DeviceAuthenticationRotationRejected.