RF Waterfall: fix the inverted colour ramp and follow the theme

[vnxdtzip]

Proposed Changes

The intensity ramp was inverted. rawLevel mapped RSSI so a strong signal
produced 255, then level = 255 - rawLevel flipped it, so the noise floor
rendered red and carriers rendered dark blue. An idle band filled the screen
with heat and real signals read as holes in it.

Dropping the inversion makes the ramp run cold to hot, and its bottom 40
levels now dissolve into the theme background so an empty band looks like the
rest of the UI. The full-gamut ramp itself is kept deliberately: in a
waterfall the colour is the measurement, not decoration.

Everything around it now follows the theme instead of a private palette.
fillScreen(0x0), TFT_BLACK, TFT_PINK, TFT_WHITE, TFT_YELLOW, TFT_DARKCYAN and
TFT_DARKGREY are gone. The header block moved from hardcoded y = 0/10/20 to
rows derived from the font height, and now repaints only when its contents
change - previously the text was rewritten every sweep, which flickered.
Screen size comes from tftWidth/tftHeight rather than tft.width()/height().

Types of Changes

Bugfix (inverted colour ramp) plus UI rework.

Verification

Flash and open RF -> Waterfall with a CC1101 attached, then compare against
the previous build on the same band:

• with no transmitter, the fall should be dark and blend into the
  background, where before it was mostly red
• keying a transmitter inside the band should paint a bright warm streak,
  where before it painted a dark blue one
• the header should not flicker while sweeping
• switching to a light theme should keep the header readable, where before
  the background stayed black

The band edges, the OK/PREV/NEXT controls and the EXIT item behave as before.

Testing

No unit test harness exists for this layer. rf_waterfall.cpp compiles clean
for m5stack-cardputer, verified in the combined tree; this branch was not
built in isolation. Not yet verified on hardware by me, and I have no CC1101 -
a reviewer with the radio should confirm the ramp direction against a known
carrier, since that is the substantive change here.

Linked Issues

None. Depends on #2754 (ui/color-helpers) for blendColors. Does not need the
SpectrumPlot component, so it can be reviewed and merged independently of the
rest of the series.

User-Facing Change

RF Waterfall: fixed an inverted colour ramp that rendered the noise floor as red and strong signals as dark blue. Signals now run cold to hot, and the surrounding UI follows the active theme.

Further Comments

The framebuffer is still a stack VLA sized from the panel width, which is
pre-existing and untouched here, but it is worth flagging: on a 480px display
that is roughly 1KB of stack per call.

---

Stacked PR. This branch is built on #2754. GitHub can only base a cross-fork PR on an upstream branch, so until it is merged the diff above also contains its commit. Review only the commit titled RF Waterfall: fix the inverted colour ramp and follow the theme; the diff shrinks on its own once the base lands.