#11213 Fix Time Off: save policies when employees come as objects or are left out

Fixes #11212

The time off policy service passed the employees list straight into the id lookup, so the GraphQL create and update mutations, and REST calls that send employee objects or leave the list out, always answered 400. The lookup now accepts ids or objects on both ORMs and is still scoped to the caller's tenant and organization. A create without employees saves a policy with no members, an update without them keeps the current members, and an explicit empty list still clears them. An entry without an id is refused with a 400 instead of being dropped.

---

Summary by cubic

Fixes the time-off policy service so creating or updating policies no longer rejects writes where employees are given as objects or the list is omitted.

• Employee lookup now accepts ids or employee rows, works on both TypeORM and MikroORM, and stays scoped to the caller's tenant and organization.
• Creating a policy without employees saves it with no members.
• Updating without employees keeps the current members; an explicit empty list still clears them.
• An employee entry without an id is now refused with 400 instead of silently clearing the members.