Fix AWS account create retry for transient service activation errors

[bshutterkion]

Summary

• Newly created AWS accounts may not have all services (e.g. CloudFormation) fully activated when the provider attempts to move them from the account cache to a project
• Account creation now has two wait phases:
  1. Poll /v3/account-cache/{id} until the account number is assigned
  2. Poll /v3/account-cache/{id}/status until the account is actually accessible in AWS (verifies the service role can be assumed and APIs called)
• The cache-to-project conversion now retries all errors until the Terraform create timeout (default 20 min) expires, rather than failing after 3 fixed attempts
• Added AccountCacheStatusResponse model for the status endpoint
• Version bumped to 0.3.33

Context

A customer creating a new AWS account and project simultaneously via Terraform was hitting:

OptInRequired: The AWS Access Key Id needs a subscription for the service

The account was created successfully in the cache, but the move to the project failed because CloudFormation wasn't yet available in the brand-new account. Manual moves from the cache worked fine since enough time had passed.

The root cause is that AWS assigns an account number before all services are fully activated. The previous code only waited for the account number, then immediately attempted the convert. Now we also verify the account is accessible via the existing /v3/account-cache/{id}/status endpoint before proceeding.

Test plan

• Verify build, vet, staticcheck, and unit tests pass
• Test with customer environment where OptInRequired error was occurring
• Verify accounts that don't hit activation delays still create and move without unnecessary wait
• Verify the status polling respects the Terraform create timeout