fix(ai): prevent copilot policy login rate limits (#8254)

- fixes #7850
- fetch the account model catalog before policy updates
- update only known, tool-capable, unconfigured models
- retry throttled login requests within a bounded delay
- preserve the existing non-retrying refresh behavior