feat(hint): persist the vs_ai idle-hint wait (wall-clock + read sanitiser)

Per the owner's call, the idle-hint gate now PERSISTS across leaving and reopening the
app, instead of the session-scoped monotonic clock: the unlock is a wall-clock instant
(hintUnlockAtMs) stamped from the robot's reply, stored on the local record, carried on
the game view + the opponent_moved move delta, and read through a sanitiser that caps it
at now + the window. So:
- the wait survives a relaunch (a stuck turn is not forgotten);
- a device clock set BACK cannot freeze the gate (the cap bounds the remaining to the
  window and self-heals on the next read);
- a clock set FORWARD just opens the hint early -- accepted as harmless for a solo game.

- lib/hints.ts hintGateRemainingMs now takes the unlock instant + clamps to the window.
- localgame: re-add hintUnlockAtMs to the record/meta; stamp it off the robot's reply;
  sanitise on read (a shared hintUnlock helper feeds stateView + the opponent_moved event).
- gamedelta + PushEvent: the move delta carries hintUnlockAtMs so the view stays fresh.
- Game.svelte: hintUnlockAt derives from the view; the tick + lock + toast unchanged.
- offline.spec.ts: also assert the lock survives a reload (the wait persisted).
- Docs FUNCTIONAL(+_ru)/ARCHITECTURE updated (persist + sanitiser, not monotonic-resets).

ui/src/game/Game.svelte

@@ -168,35 +168,19 @@
   // hint was spent in another game (see lib/hints).
   const hintCount = $derived(hintsLeft(view, app.profile?.hintBalance ?? 0));
   // A vs_ai game's hint is unlimited and wallet-free, but idle-gated (an anti-frustration aid: it
-  // unlocks only after the player has been stuck ~30 min on a turn). The wait is measured with a
-  // MONOTONIC clock (performance.now()), never a wall-clock timestamp — a device clock change (by the
-  // player or an auto-sync) must not open or freeze the gate. hintGateStart is that clock when the
-  // current turn's wait began (null = open: the human's first move, or the robot's turn); monoNow
-  // ticks so the 🔒 lifts live at the mark. A reload restarts the wait — the monotonic clock is
-  // session-scoped, and there is no tamper-proof way to carry idle time across a relaunch.
-  let hintGateStart = $state<number | null>(null);
-  let hintArmedFor = -1; // the moveCount the current wait was armed for (plain: not a reactive dep)
-  let monoNow = $state(performance.now());
-  const hintRemaining = $derived(view?.game.vsAi ? hintGateRemainingMs(hintGateStart, monoNow) : 0);
+  // unlocks only after the player has been stuck ~30 min on a turn). The unlock is a persisted
+  // wall-clock instant carried on the game view (`hintUnlockAtMs`, stamped by the source off the
+  // robot's reply and kept fresh by the move delta), so the wait survives leaving and reopening the
+  // app. It is sanitised on read (source + lib/hints cap it at now + the window) so a device clock
+  // set BACK cannot freeze the gate; a clock set forward just opens the hint early, harmless for a
+  // solo game. `now` ticks so the 🔒 lifts live at the mark. 0 = open (the human's first move).
+  let now = $state(Date.now());
+  const hintUnlockAt = $derived(view?.game.vsAi ? (view.hintUnlockAtMs ?? 0) : 0);
+  const hintRemaining = $derived(hintGateRemainingMs(hintUnlockAt, now));
   const hintGated = $derived(hintRemaining > 0);
-  // Arm the wait when it becomes the human's turn after the robot has moved; a human-first opening
-  // (no move yet, moveCount 0) is open at once. Re-arms only when the turn actually changes.
-  $effect(() => {
-    const mc = view?.game.moveCount ?? 0;
-    if (!view?.game.vsAi || !isMyTurn) {
-      hintGateStart = null;
-      hintArmedFor = -1;
-      return;
-    }
-    if (hintArmedFor !== mc) {
-      hintArmedFor = mc;
-      hintGateStart = mc === 0 ? null : performance.now();
-    }
-  });
-  // Tick the monotonic clock while a vs_ai game is open, so the gate re-evaluates and unlocks live.
   $effect(() => {
     if (!view?.game.vsAi) return;
-    const iv = setInterval(() => (monoNow = performance.now()), 10_000);
+    const iv = setInterval(() => (now = Date.now()), 10_000);
     return () => clearInterval(iv);
   });
   // RACK_SIZE mirrors the engine's rules.RackSize (7 for every current variant). The exchange
@@ -361,7 +345,7 @@
         // While composing, reload so a draft overlapping the new move is reconciled; otherwise apply
         // the move as a delta with no fetch.
         if (placement.pending.length > 0) void load();
-        else applyDelta(applyMoveDelta(cacheSnapshot(), { move: e.move, game: e.game, bagLen: e.bagLen }));
+        else applyDelta(applyMoveDelta(cacheSnapshot(), { move: e.move, game: e.game, bagLen: e.bagLen, hintUnlockAtMs: e.hintUnlockAtMs }));
       } else if (e.kind === 'your_turn' && e.gameId === id) {
         // The opponent_moved delta carries the new state; your_turn only confirms the turn. Refetch
         // only if we missed the move (our cached count trails the event's).
@@ -887,10 +871,9 @@
   }
   async function doHint() {
     // vs_ai: the idle gate replaces the wallet. While it is still closed, a tap only explains when the
-    // hint unlocks (no wallet is ever spent) — matching the 🔒 badge. Measured fresh off the monotonic
-    // clock at tap time.
+    // hint unlocks (no wallet is ever spent) — matching the 🔒 badge. Measured fresh at tap time.
     if (view?.game.vsAi) {
-      const remaining = hintGateRemainingMs(hintGateStart, performance.now());
+      const remaining = hintGateRemainingMs(hintUnlockAt, Date.now());
       if (remaining > 0) {
         showToast(t('game.hintLockedIn', { n: hintLockMinutes(remaining) }), 'info');
         return;