feat(hint): unify the vs_ai idle hint online + offline (server-enforced, monotonic)

Online vs_ai hints were broken: #207 made the vs_ai hint button always-enabled and
wallet-free (assuming all vs_ai = the offline idle-gate), but the backend still served
online vs_ai from the allowance/wallet, so over-clicking hit ErrNoHintsLeft -> a generic
error toast. Now online vs_ai uses the SAME idle-gate model as offline.

Backend: Hint() for a vs_ai game skips the allowance/wallet and increments no hints_used
(owner: vs_ai counts toward no hint statistic), and is idle-gated from the SERVER clock --
it returns ErrHintLocked (code hint_locked) until the robot's last move + 30 min, else
serves the top move. GameState/StateView expose hint_unlock_left_seconds (server-computed
seconds remaining; 0 for a human game / first move / not-your-turn). Pure helper
hintUnlockLeftSeconds unit-tested.

Wire: StateView gains hint_unlock_left_seconds (FlatBuffers, additive); pkg/wire + gateway
transcode carry it (round-trip test).

Client: the gate counts down from a MONOTONIC clock (performance.now()) anchored to the
source's seconds-left when it lands (on load from the view; to the full window when the
robot moves), so a client clock change cannot skew it and a relaunch re-reads a fresh
value. The vs_ai hint button (online + offline) shows the lock + toast; doHint handles the
hint_locked backstop by re-syncing. Replaces #207's absolute hintUnlockAtMs on the
wire/model/delta (the offline record keeps the absolute for persistence; the view exposes
seconds-left).

Docs FUNCTIONAL(+_ru)/ARCHITECTURE updated. Verified: go build/vet + game/server/transcode
tests (+ new hintUnlockLeftSeconds); ui check 0 / unit 490 / e2e 198 (one pre-existing
webkit offline flake) / app entry 114.2/115.

ui/src/lib/hints.ts

@@ -30,23 +30,17 @@ export const HINT_GATE_MS = 30 * 60 * 1000;
 
 /**
  * hintGateRemainingMs returns how long (in milliseconds) until a vs_ai game's idle hint unlocks — 0
- * once it is available. hintUnlockAtMs is the wall-clock instant the hint opens (the robot's last
- * move plus the idle window), persisted so the wait survives leaving and reopening the app; 0 or
- * undefined means the gate is open (the human's first move, or a non-gated game).
- *
- * The result is CLAMPED to the window. A wall-clock timestamp is the only way to carry idle time
- * across an app relaunch, but a device clock the player changes (or an auto-sync) could push the
- * unlock far into the future and freeze the gate; capping the remaining at the window means the wait
- * is never longer than intended and self-heals (the caller re-reads a sanitised value on load). A
- * clock moved forward simply opens the hint early — harmless for this solo anti-frustration aid.
+ * once it is available. It counts down from a MONOTONIC clock (performance.now()), so a client clock
+ * change cannot skew it: gateStartMono is performance.now() captured when the source's "seconds left"
+ * was received, gateLeftMs is that seconds-left in ms, and monoNow is performance.now() now; the
+ * remaining is gateLeftMs minus the monotonic time elapsed since the anchor. gateStartMono null means
+ * the gate is open (the human's first move, or a non-gated game). The duration comes from the source
+ * (the SERVER clock online, the device clock offline) and is re-fetched on every load, so the wait
+ * both persists across a relaunch and stays immune to a live clock change.
  */
-export function hintGateRemainingMs(
-  hintUnlockAtMs: number | undefined,
-  nowMs: number,
-  gateMs: number = HINT_GATE_MS,
-): number {
-  if (!hintUnlockAtMs) return 0;
-  return Math.min(gateMs, Math.max(0, hintUnlockAtMs - nowMs));
+export function hintGateRemainingMs(gateStartMono: number | null, gateLeftMs: number, monoNow: number): number {
+  if (gateStartMono === null) return 0;
+  return Math.max(0, gateLeftMs - (monoNow - gateStartMono));
 }
 
 /** hintLockMinutes rounds a remaining-milliseconds gap up to whole minutes for the "available in N