Device dehydration: upgrade existing user accounts to add a dehydrated device

[richvdh]

If a user already has an account with recovery set up, and the dehydrated devices are enabled on the server, we currently have no way to correctly set up a dehydrated device for them.

Setting up a dehydrated device requires us to store the dehydrated device key in 4S.

This is mitigated for users that regularly log out all of their devices anyway (i.e., the main target users for this feature), because when they log in and verify with their recovery key, dehydration is set up correctly. However, this should be more robust, as the admin & users may expect it to be effective immediately after enabling on the server.

The potential failure case is:

• Server admin enables dehydrated devices
• Everyone assumes are now protected
• They throw away their devices
• They return from a longer vacation and log in a new device: turns out they were not protected and did not receive any messages during vacation.

[richvdh]

The likely solution to this is to prompt the user to enter their recovery key so that we can add the dehydrated device.