unexpected HTTP status can be reported as success #26

Problem

drive_node_to follows every non-success answer with a GET and lets the observed state decide. That includes statuses outside the contract, so POST 204 followed by GET present, or DELETE 403 followed by GET absent, end as success. The README says only the documented success codes count as success, and the design says an unexpected status is a failure.

Fix

• A status outside the contract is a failure whatever GET shows. The GET is kept, once, so the rollback knows the node's state.
• Tests for the two dangerous cases: unexpected status then GET shows the desired state, for create and for delete.
• While here: check that the group id is a string before checking for whitespace; validate the hosts before creating the HTTP client; README wording ("key failure-path tests", the retry budget).

Acceptance criteria

• POST 204 + GET present and DELETE 403 + GET absent both fail
• create_group(123) raises a ValueError before any call
• pytest, ruff and CI green