fix: guard negative remote_id in federation_connect endpoint

Negative Python list indices bypass the intended 404 guard — e.g.
remote_id=-1 on a non-empty list silently proxied to the last remote
instead of returning 404.

Add an explicit 'idx < 0' check before the list lookup, consistent
with the sibling federation_terminal_ws_proxy endpoint (line 728).

Also adds test_federation_connect_returns_404_for_negative_remote_id
to document the expected behavior and prevent regression.

muxplex/main.py

@@ -1008,6 +1008,8 @@ async def federation_connect(
     remotes = settings.get("remote_instances", [])
     try:
         idx = int(remote_id)
+        if idx < 0 or idx >= len(remotes):
+            raise IndexError
         remote = remotes[idx]
     except (ValueError, IndexError):
         raise HTTPException(