fix(offline): unlock finished hotseat games + raise entry budget to 120

- source: a finished hotseat game is never locked (its final rack is
  shown for review, not an Unlock button); guard locked on !isOver.
- bundle-size: raise the app-entry budget 115 -> 120 KB for the hotseat
  UI (PIN pad, roster, host menu), which lives in the always-loaded New
  Game / Game / Lobby screens; the offline engine + PIN hashing stay lazy.

ui/scripts/bundle-size.mjs

@@ -23,10 +23,13 @@ const DIST = 'dist';
 // wiring, to 112 for the PWA install feature, to 113 for the offline-mode wiring, to 114 for
 // the offline auto-detect (the cold-start reachability check and the "no connection" dialog live in
 // the boot path), then to 115 for the vs_ai idle-hint gate — its monotonic clock, lock badge and
-// countdown toast live in the always-loaded game screen (Game.svelte). The heavy parts — the dict
-// loader, the move generator and the preload orchestration — still stay in lazy chunks. Scoped CSS
-// lands in the CSS chunk, not this JS budget.
-const BUDGET = { app: 115, shared: 30, landing: 5 };
+// countdown toast live in the always-loaded game screen (Game.svelte) — and to 120 for the offline
+// pass-and-play (hotseat) mode: the on-screen PIN pad, the creation roster and the in-game host menu
+// live in the always-loaded New Game / Game / Lobby screens (the offline engine and the tiny PIN
+// hashing stay in lazy chunks / are negligible). The heavy parts — the dict loader, the move
+// generator and the preload orchestration — still stay in lazy chunks. Scoped CSS lands in the CSS
+// chunk, not this JS budget.
+const BUDGET = { app: 120, shared: 30, landing: 5 };
 
 // gzipped returns the gzipped byte size of a built asset, or 0 when the reference is not a
 // local file (e.g. the Telegram SDK loaded from a CDN) or is missing.