Re-probe one account's console-access policy version

Assumes the account's wraps-console-access-role and probes which version of the Wraps console policy it carries, then persists the reading. Exists so a customer who has just repaired their role sees it reflected immediately rather than waiting for the hourly sweep, which does not re-probe an account it checked within the last day. Rate limited to one probe per account per minute; inside that window, or when SES throttles the probe, the stored reading is returned with rechecked: false.