feat(offline): PIN lock primitives + Apple-style keypad

Groundwork for offline pass-and-play (hotseat) seat/host PIN locks:
- lib/pin.ts: salted SHA-256 PinLock (newSalt/hashPin/newLock/verifyPin);
  a social lock for a shared device (documented, not cryptography).
- components/PinPad.svelte: 4-digit keypad (set/verify/change), auto-submit
  on the 4th digit, shake on mismatch, hardware-keyboard support.
- i18n: pin.* keys (en + ru).

Engine/source/UI wiring follows.

ui/src/lib/i18n/en.ts

@@ -389,6 +389,15 @@ export const en = {
   'error.game_active': 'Available only after the game is finished.',
   'error.invalid_profile': 'Some profile fields are invalid.',
   'error.already_confirmed': 'This email is already confirmed.',
+
+  'pin.enter': 'Enter PIN',
+  'pin.create': 'Create a PIN',
+  'pin.repeat': 'Repeat the PIN',
+  'pin.enterCurrent': 'Enter current PIN',
+  'pin.mismatch': "PINs don't match",
+  'pin.wrong': 'Wrong PIN',
+  'pin.setNew': 'Set a new PIN',
+  'pin.remove': 'Remove PIN',
 } as const;
 
 export type MessageKey = keyof typeof en;