sdk: raise NovemException on API errors instead of a print placeholder

[bjornars]

Draft — implements the fail-hard option from #235 for discussion.

What

Adds raise_on_response(r) (api_ref) — parses the server message and any rejected lines and raises the matching NovemException subclass (401/403/404/409, generic NovemException otherwise) — and replaces the print("should raise a general error") placeholder in all eight write sites (vis/group/job/repo, the create_* PUT + api_write POST). Keeps the intentional 409-on-create no-op carve-out.

Why draft

This is the fail-hard direction from #235 — a behavioral change: writes that previously silently no-op'd on a non-2xx now raise. The open questions there should be settled before this goes ready:

• raise on any non-ok vs 4xx-only (keep 5xx softer/retryable)
• opt-in raise_on_error/strict flag vs hard default (existing users)
• does it warrant a major version bump

Verified

Against a live dev API, mail.bcc = [30 addrs over the 25 cap] now raises instead of silently storing nothing:

NovemException: No recipients were changed, the request contained entries that
could not be applied [[email protected]: …maximum of 25 external address
recipients … exceeds it.; …]

The server-side 400 that makes this observable is novem-code/gaia#2810.

Before ready

• unit test: 4xx + rejected body → raises with the reason
• resolve the fail-soft/hard direction (SDK silently swallows non-2xx API responses (fail soft vs fail hard) #235)

Refs #235 · SDK half of novem-code/gaia#2656

[bjornars]

@sondove I know there are concerns here. Maybe find a way to opt in to hard-failures, vs the default way of just on error goto next.