feat(hint): persist the vs_ai idle-hint wait (wall-clock + read sanitiser)

Per the owner's call, the idle-hint gate now PERSISTS across leaving and reopening the
app, instead of the session-scoped monotonic clock: the unlock is a wall-clock instant
(hintUnlockAtMs) stamped from the robot's reply, stored on the local record, carried on
the game view + the opponent_moved move delta, and read through a sanitiser that caps it
at now + the window. So:
- the wait survives a relaunch (a stuck turn is not forgotten);
- a device clock set BACK cannot freeze the gate (the cap bounds the remaining to the
  window and self-heals on the next read);
- a clock set FORWARD just opens the hint early -- accepted as harmless for a solo game.

- lib/hints.ts hintGateRemainingMs now takes the unlock instant + clamps to the window.
- localgame: re-add hintUnlockAtMs to the record/meta; stamp it off the robot's reply;
  sanitise on read (a shared hintUnlock helper feeds stateView + the opponent_moved event).
- gamedelta + PushEvent: the move delta carries hintUnlockAtMs so the view stays fresh.
- Game.svelte: hintUnlockAt derives from the view; the tick + lock + toast unchanged.
- offline.spec.ts: also assert the lock survives a reload (the wait persisted).
- Docs FUNCTIONAL(+_ru)/ARCHITECTURE updated (persist + sanitiser, not monotonic-resets).

docs/ARCHITECTURE.md

@@ -1253,10 +1253,12 @@ device-local games** (reconstructed by replaying the IndexedDB move journal) and
 creates one through the in-browser engine — the same game screen then drives it, the robot replying
 locally; online-only affordances (the Stats tab, the friend/random options in New Game) are disabled
 or hidden. A local `vs_ai` hint is unlimited and wallet-free but idle-gated (unlocked ~30 min into a
-stuck turn); the gate is enforced **client-side against a monotonic clock** (`performance.now()`,
-`lib/hints`), never a wall-clock timestamp — a device clock the player controls must not be able to
-open or freeze it, so the wait is session-scoped (a reload restarts it). An online `vs_ai` game will
-gate the same way but from the server's clock (a follow-up). To have data ready before the switch, the **Profile advertises the current dictionary
+stuck turn). The gate is a **persisted wall-clock unlock instant** (`hintUnlockAtMs` on the record +
+the game view, stamped from the robot's reply, carried on the move delta), so the wait survives a
+relaunch — but it is **sanitised on read** (capped at `now + window`, `lib/hints` + `source.ts`) so a
+device clock the player sets **back** cannot push the unlock away and freeze the gate; a clock set
+**forward** merely opens the hint early, harmless for a solo game. An online `vs_ai` game will gate the
+same way but from the server's clock (a follow-up). To have data ready before the switch, the **Profile advertises the current dictionary
 version per variant** (`dict_versions`,
 filled from the registry on the existing cold-start profile request — no extra round-trip), and an
 eligible installed PWA (standalone web + confirmed email) **background-preloads** those dictionaries

docs/FUNCTIONAL.md

@@ -220,9 +220,11 @@ personal hint wallet once the per-game allowance is spent. Against the robot
 anti-frustration aid: one unlocks only after the player has been **stuck ~30 minutes
 on a turn** (timed from the robot's last move; the very first move, before the robot
 has played, is exempt). While gated the hint button carries a small **🔒 lock** and a
-tap shows how long remains; the lock lifts live at the mark. The wait uses a steady
-in-app timer, not the device clock — changing the clock cannot open or freeze it
-(though a reload restarts the wait). The game ends when the
+tap shows how long remains; the lock lifts live at the mark. The wait **persists across
+leaving and reopening the app**, so a stuck turn is not forgotten. It stays robust to a
+device clock change: the remaining is capped at the window, so a clock set back cannot
+freeze it, and a clock set forward merely opens the hint early — harmless in a solo game.
+The game ends when the
 bag empties and a player clears their rack, after 6 consecutive scoreless turns,
 by resignation, or by the per-game move timeout (5 minutes to 24 hours, default
 24 hours): a missed turn auto-resigns, except while the player is inside their

docs/FUNCTIONAL_ru.md

@@ -227,9 +227,10 @@ e-mail) либо ввод фразы. Активные игры форфейтя
 анти-фрустрация: подсказка открывается, только когда игрок **застрял на ходу ~30 минут**
 (отсчёт от последнего хода робота; самый первый ход, до хода робота, исключён). Пока гейт
 закрыт, кнопка подсказки несёт маленький **🔒 замок**, а тап показывает, сколько осталось;
-замок снимается вживую в нужный момент. Отсчёт идёт по ровному внутриигровому таймеру, а не
-по системным часам — их перевод не откроет и не заморозит гейт (но перезагрузка отсчёт
-начинает заново). Партия
+замок снимается вживую в нужный момент. Отсчёт **переживает выход и повторный вход в
+приложение**, так что застрявший ход не забывается. И он устойчив к переводу часов: остаток
+ограничен окном, поэтому перевод назад не заморозит гейт, а перевод вперёд просто откроет
+подсказку раньше — безвредно в соло-игре. Партия
 завершается, когда мешок пуст и игрок выложил стойку, после 6 подряд бесплодных
 ходов, по сдаче, либо по таймауту хода (от 5 минут до 24 часов, дефолт 24 часа):
 пропущенный ход означает авто-сдачу, кроме как когда игрок внутри своего