prepareDeviceAuthenticationRecovery

Starts or resumes a device authentication recovery of this device (docs/device-recovery.md): for a device whose registered device authentication key is lost, authorizer, another registered device of the same user, can authorize a replacement key.

Creates the replacement key pair once and keeps it as pending recovery key, sealed at rest; later calls reuse it until the recovery completes or is cancelled. The active key (if any) is not touched. Returns a request signed with the replacement key (proof of possession), stamped with the current time and a fresh nonce. The application transfers it to authorizer (for example with DeviceRecoveryCodec), which calls authorizeDeviceRecovery; this device then calls completeDeviceAuthenticationRecovery within DeviceRecovery.VALIDITY_WINDOW of the request time. No network I/O.

Recovers server authentication only. The messaging identity, prekeys, sessions and identity pins are not changed. Needs the local identity (SecureMessageClientException.NotInitialized); throws SecureMessageClientException.InvalidDeviceRecovery if authorizer is this device or belongs to another user, and SecureMessageClientException.DeviceAuthenticationRotationInProgress while a routine rotation is pending and SecureMessageClientException.LastDeviceRecoveryInProgress while a last-device recovery is pending.