completeLastDeviceRecovery

Recovers this device's server authentication with the offline recoveryKey (docs/last-device-recovery.md): requests a challenge from the server, signs it together with the pending replacement key (with recoveryKey and, as proof of possession, with the replacement key), submits it, and once the server replaced the registered key makes the pending key the active device authentication key. recoveryKey is used only in memory and never stored.

Safe to call again after a failure, a lost response or a crash before the local promotion: if the server rejects the recovery as conflicting, expired or for an invalid challenge, this asks the server whether the pending key is registered already (resolveLastDeviceRecovery) before failing. Other failures keep the pending key for another attempt. Throws SecureMessageClientException.NoPendingLastDeviceRecovery, SecureMessageClientException.InvalidLastDeviceRecovery and SecureMessageTransportException.LastDeviceRecoveryRejected.