completeLastDeviceRecoveryKeyReset

Completes the pending recovery key reset with newKey (docs/recovery-key-reset.md): this device's signed request and newKey's proof of possession over the pending reset. The server accepts it only from the reset's eligibility time on (its own clock). newKey is not stored.

Back up newKey before calling this, exactly as for a rotation: once the server accepted it, the old key recovers nothing any more.

Reads the recovery key status first: if newKey is already active (a lost response, a restart), returns LastDeviceRecoveryKeyResetResult.ALREADY_ACTIVE without sending anything. Throws SecureMessageClientException.LastDeviceRecoveryKeyNotConfigured if no key is active, SecureMessageClientException.LastDeviceRecoveryKeyResetNotPending if no reset is pending, IllegalArgumentException if newKey is the key being replaced, and SecureMessageTransportException.RecoveryKeyResetRejected if the server refused (NOT_YET_ELIGIBLE, CONFLICT, …). Never called implicitly.