feat(hint): persist the vs_ai idle-hint wait (wall-clock + read sanitiser)

Per the owner's call, the idle-hint gate now PERSISTS across leaving and reopening the
app, instead of the session-scoped monotonic clock: the unlock is a wall-clock instant
(hintUnlockAtMs) stamped from the robot's reply, stored on the local record, carried on
the game view + the opponent_moved move delta, and read through a sanitiser that caps it
at now + the window. So:
- the wait survives a relaunch (a stuck turn is not forgotten);
- a device clock set BACK cannot freeze the gate (the cap bounds the remaining to the
  window and self-heals on the next read);
- a clock set FORWARD just opens the hint early -- accepted as harmless for a solo game.

- lib/hints.ts hintGateRemainingMs now takes the unlock instant + clamps to the window.
- localgame: re-add hintUnlockAtMs to the record/meta; stamp it off the robot's reply;
  sanitise on read (a shared hintUnlock helper feeds stateView + the opponent_moved event).
- gamedelta + PushEvent: the move delta carries hintUnlockAtMs so the view stays fresh.
- Game.svelte: hintUnlockAt derives from the view; the tick + lock + toast unchanged.
- offline.spec.ts: also assert the lock survives a reload (the wait persisted).
- Docs FUNCTIONAL(+_ru)/ARCHITECTURE updated (persist + sanitiser, not monotonic-resets).

docs/ARCHITECTURE.md

@@ -1253,10 +1253,12 @@ device-local games** (reconstructed by replaying the IndexedDB move journal) and
 creates one through the in-browser engine — the same game screen then drives it, the robot replying
 locally; online-only affordances (the Stats tab, the friend/random options in New Game) are disabled
 or hidden. A local `vs_ai` hint is unlimited and wallet-free but idle-gated (unlocked ~30 min into a
-stuck turn); the gate is enforced **client-side against a monotonic clock** (`performance.now()`,
-`lib/hints`), never a wall-clock timestamp — a device clock the player controls must not be able to
-open or freeze it, so the wait is session-scoped (a reload restarts it). An online `vs_ai` game will
-gate the same way but from the server's clock (a follow-up). To have data ready before the switch, the **Profile advertises the current dictionary
+stuck turn). The gate is a **persisted wall-clock unlock instant** (`hintUnlockAtMs` on the record +
+the game view, stamped from the robot's reply, carried on the move delta), so the wait survives a
+relaunch — but it is **sanitised on read** (capped at `now + window`, `lib/hints` + `source.ts`) so a
+device clock the player sets **back** cannot push the unlock away and freeze the gate; a clock set
+**forward** merely opens the hint early, harmless for a solo game. An online `vs_ai` game will gate the
+same way but from the server's clock (a follow-up). To have data ready before the switch, the **Profile advertises the current dictionary
 version per variant** (`dict_versions`,
 filled from the registry on the existing cold-start profile request — no extra round-trip), and an
 eligible installed PWA (standalone web + confirmed email) **background-preloads** those dictionaries