rotateLastDeviceRecoveryKey

Replaces this user's offline recovery key currentKey with newKey (docs/recovery-key-lifecycle.md). Two authorities: this device's signed request, and currentKey's signature; newKey proves possession. Neither key is stored.

Back up newKey before calling this. Create it with createLastDeviceRecoveryKey, have the user store LastDeviceRecoveryKey.encode offline and confirm it, and only then rotate: once the server accepted the rotation, currentKey no longer recovers anything, and a lost newKey cannot be replaced by a device alone.

Reads the status first. If newKey is already active (an earlier call's response was lost, or the application restarted), returns LastDeviceRecoveryKeyRotationResult.ALREADY_ACTIVE without sending anything; call it again with the same keys to resolve an unknown outcome. Throws SecureMessageClientException.LastDeviceRecoveryKeyNotConfigured if no key is active, SecureMessageClientException.LastDeviceRecoveryKeyMismatch if neither key is the active one, and SecureMessageTransportException.RecoveryKeyRotationRejected if the server refused (for example CONFLICT if another transition won). Never called implicitly.