feat(cw): draw the whole audio band so an out-of-window tone is visible

The waterfall showed only the model's 400-1200 Hz window, so a tone outside it
was absent from the picture entirely. Measured on keyed audio, the brightest
column in that narrow view swings 1.01x between key-down and key-up against
13.76x for a tone in range - it carries no keying at all, so the operator could
not tell a signal was present, let alone where it was. Markers alone could not
fix that: they pointed at a frequency with nothing drawn there.

compute() now takes an optional bin range, defaulting to the model's own, so the
decoder path is byte-identical and the golden-vector test still holds. The
display asks for DC to Nyquist, 129 bins against 65. The FFT already computed
every bin - this only changes which are kept - so the cost is a wider copy.

The decoder window is framed and faintly lifted, since half the picture is now
outside what the model reads and nothing said which half.

Marker fixes found while reviewing the render: the tone marker was orange, which
is a colour the inferno ramp itself passes through, so a marker sitting on the
trace it pointed at was indistinguishable from the keying gaps in that trace -
invisible in exactly the case it existed for. It is cyan now, and both markers
are pips in a gutter above the spectrum rather than lines across it.

Also from the release audit:

- compute()'s bin-count guard was written as a three-term disjunction, which any
  custom range satisfies regardless of bin count, leaving the model invariant
  unenforced for the caller most able to break it. Rewritten as an implication,
  with a Nyquist bound so no range can index past the FFT output.
- signalStrength was gated on a confirmed out-of-window tone, which is false when
  detection fails - and it fails for a slow fist, measured at prominence 2.5
  against a 4.5 threshold for 15% duty. So the meter still read half scale beside
  an empty transcript. It now requires a tone confirmed decodable: 11 flow
  combinations, 3 wrong before, 0 wrong after.
- detectedToneHz never expired, so after retuning into the band the hint kept
  naming the frequency the operator had left, indefinitely. It now clears after
  10 s without a tone, which is clear of any real gap - the longest being 1.7 s
  between words at 5 WPM.
- The waterfall label read estimatedPitch while the hint read detectedToneHz, two
  numbers up to 800 Hz apart both claiming to be the tone. Both read the latter.
- Removed a redundant toFloat() that the compiler warned about.

Accessibility, untouched until now: the waterfall was a bare Canvas and the AMSAT
day cells bare Boxes, so both announced nothing at all - on the status page that
is the entire content of the screen. Both now carry a contentDescription naming
the tone or the day's worst status and report count. The AMSAT tap target goes
from 28 dp to 48 dp with the coloured tile still 28 dp, so the grid keeps its
density. Strings in all nine locales for both modules.

core/data/src/main/java/com/rtbishop/look4sat/core/data/cw/CwDeepDecoder.kt

@@ -87,6 +87,9 @@ class CwDeepDecoder(
         /** Detection cadence; re-running it on every 100 ms chunk would be wasteful. */
         const val DETECT_INTERVAL_MS = 2000
 
+        /** Silence after which a tone reading is treated as stale. See runDetection. */
+        const val TONE_EXPIRY_MS = 10_000L
+
         /**
          * Minimum change in the required shift before the window is re-shifted.
          *
@@ -139,6 +142,9 @@ class CwDeepDecoder(
     /** Decides what shift to apply from successive tone estimates. */
     private val shiftDecider = CwShiftDecider(SHIFT_HYSTERESIS_HZ)
 
+    /** Wall clock of the last scan that actually found a tone, for [TONE_EXPIRY_MS]. */
+    private var lastToneAtMs = 0L
+
     /** Wall clock of the last detection scan, throttling it to [DETECT_INTERVAL_MS]. */
     private var lastDetectAtMs = 0L
 
@@ -328,6 +334,7 @@ class CwDeepDecoder(
             dropBufferedAudio()
             _activeShiftHz.value = 0f
             _detectedToneHz.value = null
+            lastToneAtMs = 0L
             shiftDecider.reset()
             lastDetectAtMs = 0L
             detectionPool.clear()
@@ -380,8 +387,18 @@ class CwDeepDecoder(
 
         // Published either way: the UI needs the real pitch to say why nothing decodes
         // when shifting is off and the tone is out of range. Held through silences for
-        // the same reason the shift is - CW is gaps, and a gap is not a retune.
-        analysis.toneHz?.let { _detectedToneHz.value = it.toFloat() }
+        // the same reason the shift is - CW is gaps, and a gap is not a retune - but not
+        // indefinitely: without an expiry the last out-of-band reading survived every
+        // silent scan, so after retuning into the band the hint kept naming a frequency
+        // the operator had left. Ten seconds clears comfortably any real gap, the longest
+        // being about 1.7 s at 5 WPM between words plus a few seconds of thinking.
+        val tone = analysis.toneHz
+        if (tone != null) {
+            _detectedToneHz.value = tone
+            lastToneAtMs = System.currentTimeMillis()
+        } else if (System.currentTimeMillis() - lastToneAtMs > TONE_EXPIRY_MS) {
+            _detectedToneHz.value = null
+        }
 
         if (!shiftEnabled) return
 
@@ -516,14 +533,17 @@ class CwDeepDecoder(
         val mean = total / count
         val prominence = ((bestValue - mean) / bestValue).coerceIn(0f, 1f)
 
-        // Zero when the tone is out of range and not being shifted in. The spectrogram
-        // normalises within the window, so a tone outside it still scores well on the
-        // leakage banked up against the nearest edge - measured at 0.78 for a 1500 Hz
-        // tone, a near-full meter next to an empty transcript. The meter is a claim that
-        // something decodable is present, and in that state nothing is.
-        val outOfRange = _activeShiftHz.value == 0f &&
-            _detectedToneHz.value?.let { !CwToneShifter.isInsideWindow(it) } == true
-        _signalStrength.value = if (outOfRange) 0f else prominence
+        // The meter claims something decodable is present, so it needs a tone the scan has
+        // actually confirmed inside the window - not merely the absence of a confirmed
+        // out-of-window one. Requiring the confirmation is what covers the intermittent
+        // case: a slow fist out of band at 15% duty scores 2.5 against MIN_PROMINENCE 4.5,
+        // so no tone is reported, and a condition keyed on "confirmed outside" stayed false
+        // and let the meter read half scale on window-edge leakage beside an empty
+        // transcript - the exact reading this gate exists to suppress.
+        val confirmed = _detectedToneHz.value
+        val decodable = confirmed != null &&
+            (_activeShiftHz.value != 0f || CwToneShifter.isInsideWindow(confirmed))
+        _signalStrength.value = if (decodable) prominence else 0f
     }
 
     override fun reset() {
@@ -533,6 +553,7 @@ class CwDeepDecoder(
         archiveSize = 0
         _estimatedPitch.value = null
         _detectedToneHz.value = null
+        lastToneAtMs = 0L
         _signalStrength.value = 0f
         _lastInferenceMs.value = 0
         // Re-detect from scratch: the operator may have retuned before resetting.