Device dehydration: upgrade existing user accounts to add a dehydrated device

If a user already has an account with recovery set up, and the dehydrated devices are enabled on the server, we currently have no way to correctly set up a dehydrated device for them.

Setting up a dehydrated device requires us to store the dehydrated device key in 4S.

This is mitigated for users that regularly log out all of their devices anyway (i.e., the main target users for this feature), because when they log in and verify with their recovery key, dehydration is set up correctly. However, this should be more robust, as the admin & users may expect it to be effective immediately after enabling on the server.

The potential failure case is:
* Server admin enables dehydrated devices
* Everyone assumes they are now protected
* They throw away their devices
* They return from a longer vacation and log in a new device: turns out they were not protected and did not receive any messages during vacation.

The fix is to pop up a toast when we detect that the server supports dehydrated devices and the user doesn't have one.

When they click the button, we prompt for recovery key and then create the dehydrated device as usual.

This should fit with the existing code that checks for things and displays toasts. We can detect whether they have a dehydrated device by looking for the relevant secret in 4S.