prepareDeviceAuthenticationRotation

Starts or resumes a routine rotation of this device's authentication key (docs/device-authentication-rotation.md), for a device that still holds its registered key K1. Creates the replacement key pair K2 once and keeps it as pending rotation key, sealed at rest; later calls reuse it until the rotation completes or is cancelled. K1 stays the active key and keeps signing every request. No network I/O: call completeDeviceAuthenticationRotation.

Rotates server authentication only. The messaging identity, prekeys, sessions, identity pins and their verification are not changed. Needs the local identity and K1 (SecureMessageClientException.NotInitialized if either is missing); throws SecureMessageClientException.DeviceAuthenticationRecoveryInProgress while a device recovery is pending and SecureMessageClientException.LastDeviceRecoveryInProgress while a last-device recovery is pending. A device that lost K1 uses device recovery instead (docs/device-recovery.md, docs/last-device-recovery.md).