`jamulusclient/setFaderLevel` accepts a channel index one past the end

**🤖 AI:** Split out of #3884 at pljones's request — same inclusive-vs-exclusive family as the `customdirectoryindex` crash also split from that issue, at a different boundary; this one cannot crash.

Valid fader indices are `0..MAX_NUM_CHANNELS-1` = `0..149` (`vecpChanFader` is sized `MAX_NUM_CHANNELS` at `src/audiomixerboard.cpp:1020`; `MAX_NUM_CHANNELS` is 150 at `src/global.h:233`). The validator rejects only `channelIndex > MAX_NUM_CHANNELS` (`src/clientrpc.cpp:397`), so 150 is accepted. Driven over the JSON-RPC socket:

| channelIndex | response |
|---|---|
| 149 | `{"result":"ok"}` |
| **150** | **`{"result":"ok"}`** |
| 151 | `{"error":{"code":-32602,"message":"...out-of-range"}}` |

This cannot crash: every consumer re-guards with `< MAX_NUM_CHANNELS` (`src/audiomixerboard.cpp:1461`, and the headless path at `src/client.cpp:956`), so channel 150 is silently dropped while the caller is told `"ok"`. Fix: `>` → `>=`. The house pattern elsewhere is exclusive already — `MathUtils::InRange ( iCurChanID, 0, iMaxNumChannels )` at `src/server.cpp:1386`.

Measured on `main` @ `8b667a3a`; line numbers re-verified against `origin/main` @ `11a28d57e33506fc84cb9b5ee02097931c1e35a3` on 2026-08-21 — two of the five shifted since the original measurement (`clientrpc.cpp` 371→397, `client.cpp` 954→956); `audiomixerboard.cpp:1461` and the rest are unchanged, code and behavior unchanged throughout.

---

🤖 *This message was written by AI and reviewed by @mcfnord.*