Refactor campaign delivery decision paths

tests/test_report_email_security.py

@@ -42,6 +42,16 @@ def test_report_email_recipient_schema_rejects_unsafe_addresses(recipients: list
         ReportEmailRequest.model_validate({"to": recipients})
 
 
+def test_report_email_recipient_error_identifies_the_invalid_list_item() -> None:
+    with pytest.raises(ValidationError) as captured:
+        ReportEmailRequest.model_validate({
+            "to": ["first@example.test", "invalid recipient", "third@example.test"],
+        })
+
+    assert captured.value.errors()[0]["loc"] == ("to", 1)
+    assert "email addresses" in captured.value.errors()[0]["msg"]
+
+
 def test_report_jobs_csv_attachment_requires_recipient_export_permission() -> None:
     payload = ReportEmailRequest(to=["recipient@example.test"], attach_jobs_csv=True)
     principal = SimpleNamespace(tenant_id="tenant-1")