docs(offline): document hotseat pass-and-play

ARCHITECTURE (offline section) + FUNCTIONAL (+_ru mirror): the local
pass-and-play mode — host/referee master PIN, per-seat optional PIN
locks (social lock, salted SHA-256, client-only), the board-visible seat
unlock, host overrides (skip/exclude/terminate), no hints/chat, and the
master-PIN-gated lobby deletion.

docs/FUNCTIONAL.md

@@ -269,8 +269,8 @@ statistics.
 An installed web PWA signed in with a confirmed email can switch to a deliberate **offline mode**
 (Settings → Play mode). Offline, the app never touches the network: the header turns blue with an
 *Offline* chip, the lobby lists only the games stored on the device, and online-only surfaces are
-disabled or hidden (the Stats tab; the *with friends* and *random opponent* options in New Game).
-Only **vs_ai** games are playable — New Game creates a device-local game against the robot, which
+disabled or hidden (the Stats tab; the *random opponent* option in New Game).
+A New Game against the robot creates a device-local **vs_ai** game — it
 plays entirely in the browser with no backend. Local games are kept on the device, visible only in
 offline mode, and never sync to the account. So a game can be created and played with no connection,
 the app quietly preloads the dictionaries for the player's enabled variants while still online, and
@@ -280,6 +280,20 @@ and waits briefly, and if they cannot be readied it stays online with a short *n
 (the download keeps running in the background, so a later switch is instant). The mode is
 device-scoped and sticky across launches.
 
+Offline, New Game's **with friends** starts a **local pass-and-play** game for 2-4 people sharing one
+device. You first set a **host (leader) password** — a 4-digit PIN entered on a lock-screen-style
+keypad; until it is set the player rows stay locked. The app then asks whether you are playing too —
+if so you take the first seat with your profile name. You name each player (2 to 4; add or remove
+rows, where a removal asks for the leader password) and may give any seat its **own optional PIN**.
+During the game the board is always visible, but a PIN-locked seat shows an **Unlock** button in place
+of its rack until its owner enters the PIN — so the device passes hand to hand and only a protected
+seat hides its letters; the lock returns each turn. The **leader** (the host button in the game) can,
+with the leader password, **skip** the current player's turn, **remove** a player, or **end the game
+early** — an early end discards the game with no winner or loser. Hints and chat are off in a
+pass-and-play game. A game that finishes normally is saved to the offline lobby like any other;
+deleting any pass-and-play game — running or finished — from the lobby asks for the leader password,
+so no one can wipe a game the moment they have moved.
+
 The app also **enters offline mode on its own** when it cannot reach the network. On a cold launch
 with no connection it switches to offline for that session; when the device is online but the gateway
 stays silent for a few seconds it asks first — *No connection. Switch to offline mode?*, with