replaceForRotation

Replaces the device's key by a routine rotation (docs/device-authentication-rotation.md) in one atomic step, together with the claim of the rotation's nonce (AuthenticationNonceRepository, same nonces, under the device's address). In this order:

1. the device has no registration: RotationReplacementResult.NOT_REGISTERED;

2. the device's current key was installed by the rotation with RotationReplacement.rotationId: RotationReplacementResult.ALREADY_APPLIED, nothing written;

3. the key or epoch differ from RotationReplacement.expected, or the replacement key is the current key: RotationReplacementResult.CONFLICT, nothing written;

4. the epoch is Long.MAX_VALUE: RotationReplacementResult.EPOCH_EXHAUSTED, nothing written;

5. prunes nonces older than RotationReplacement.pruneBefore and claims the nonce; already claimed: RotationReplacementResult.REPLAY (the prune may commit);

6. stores the replacement key, epoch + 1, the rotation ID and RotationReplacement.installedAt as installation time, and clears the recovery ID and the last-device recovery ID: RotationReplacementResult.REPLACED.

The same compare-and-set as replaceForRecovery: of a recovery and a rotation from the same state, exactly one replaces the key. Nothing else changes: prekeys, mailboxes and other nonces stay.