Clearer errors for invalid schedule recipients

A typo in a notify recipient ID used to pass validation and only fail later when the schedule actually fired, surfacing as a confusing "is not a tenant member" failure. Schedules now reject invalid recipient IDs at creation time with a clear error message.