Fix profile ARN resolution before account refresh calls

[STA1N156]

What changed

This resolves the account profile ARN before calling REST endpoints that require it, including getUsageLimits and ListAvailableModels.

Why

Some refreshed credentials return a valid access token but do not include profileArn in the refresh response. The streaming path already resolves the profile ARN before sending messages, but the REST refresh/model-list paths could call AWS without it and receive:

HTTP 403: {"message":"User is not authorized to make this call.","reason":null}

That can make a healthy account look unauthorized during admin refresh/model refresh.

Validation

• Reproduced with a credential whose token refresh returns no profileArn.
• Confirmed getUsageLimits and ListAvailableModels return 403 without profileArn.
• Confirmed both return 200 after resolving and attaching profileArn.