requestLastDeviceRecoveryKeyReset

Requests a delayed reset of the authenticated device's user's offline recovery key, for when that key is lost (docs/recovery-key-reset.md). The reset is bound to the active key and epoch; its request time is clock's time and its eligibility time follows from the policy; the request chooses neither. If a reset is pending already, it is returned unchanged (created = false): the delay never restarts. Throws RecoveryKeyResetException.NotAvailable without a policy, and RecoveryKeyResetException for no active key, a changed registration or an exhausted epoch. Last-device recovery challenges stay valid.