enableRecovery now takes an optional passphrase and returns the recovery
key as the suspend result (like resetRecoveryKey), avoiding the
flow/return-value race. For the passphrase path the SDK-derived base58
key is kept out of the session-scoped progress flow so it is never
surfaced to the user; the caller receives it as the return value and is
responsible for scrubbing it.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Jenna Vassar
0cb9d2911d